Background

After waiting for the Hummingbird release for the LaFonera 2.0G a long time and discussed with the Fon support team when 3G dongles will work, I gave up and installed OpenWRT on my LaFonera 2.0G router.

I’m sorry FON, you have a cool idea and nice routers but your unlogical approach to the users and communtity, finally got me to install plain OpenWRT instead.

Installation

After alot of googling and testing and downloading, reading and so on, I finally run into a guide that worked for me.

Most of the descriptions and howto assumes that the RedBoot will accept to download a new firmware via TFTP, this is true with the early releases of 2.0G , but the one sold now do not have this feature.

The trick is to install a firmware that allows changing the RedBoot partition of the memory, change the RedBoot parttion and install OpenWRT via TFTP.

The guide is unfortunatly in French, but google translate helped me to translate it to English.

The pitfalls I run into is to reboot the device several timesafter installing the hacked version of FON firmware: FON2202_2.2.5.0_Flipper_RedBootC_VoteGOP.image

The only difference is that I used a later version of OpenWRT. I used Backfire 10.03 instead of Kamikaze 8.9.1

Background

After getting fedup with the bad fon support I decided to give a new wireless router a try. After browsing internet and openwrt forums I thought that a Linksys WRT160NL would fulfill my requirements:

The requrements are:

• N
• 3G USB dongle
• Cheap

Packing up

The installation from Linksys is crap, a CD comes with the product and if you want to configure it you need to install software from the CD. The only supported operating systems are windows or Mac, I run linux.

I skipped the CD and connected my Linux box with a ethernet cable to the router. I tried to connect to http://192.168.1.1 and got a login screen.

After some googling I found that the default login was blank and the password admin.

I managed to configure my new router after logging in. I do not now the purpose of the CD, real stupid.

Install OpenWRT

I read the instructions to get OpenWRT on my Linksys WRT160NL and tried the "OEM easy installation". According to the instruction openwrt-ar71xx-wrt160nl-squashfs.bin is the image to install. Unfortunatly I get an errormessage " Firmware Upgrade Failed!"

I upgraded the firmware to the latest Linksys firmware and after that tried the OpenWRT firmware with the same error message.

After some bad language and alot of googling I found a bug reported that the version I tried to install always gives that message when installed from the Linksys webgui.

So I tried the Beta version instead and finally I success message.

I telneted to 192.168.1.1 and run passwd to change my password.

ssh to 192.168.1.

run:

root@OpenWrt:~# opkg update

root@OpenWrt:~# opkg install kmod-ath9k

root@OpenWrt:~# opkg install  hostapd

And start configure.

Update BETA to stable version

It was a annoying feeling to run beta when a stable version existed.

I used the luci webgui to update the firmware to the stable version and it looked alright. I managed to log in both with ssh and webgui.

But when I tried to install a new package it gave me an error message that there was no free disk, sigh!

I installed the BETA version and it worked, tried RC3 and the same problem with no free disk.

After some bad language and a lot of fiddeling I updated to the stable with the checkbox "Keep configuration files" unchecked and this time it works flawless.

Follow the guidlines above to change root password, update the software package list, install wlansupport, WAP support  and start configure.

A succefull login below:

peter@peter-laptop:~$ ssh -l root 192.168.1.1
root@192.168.1.1's password:

BusyBox v1.15.3 (2010-04-06 03:14:11 CEST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 Backfire (10.03, r20728) --------------------------
  * 1/3 shot Kahlua    In a shot glass, layer Kahlua
  * 1/3 shot Bailey's  on the bottom, then Bailey's,
  * 1/3 shot Vodka     then Vodka.
 ---------------------------------------------------

root@WRT160NL:~# uname -a
Linux WRT160NL 2.6.32.10 #20 Tue Apr 6 15:01:26 CEST 2010 mips GNU/Linux

- OpenBSD 4.7 RELEASED -------------------------------------------------

May 19, 2010.

We are pleased to announce the official release of OpenBSD 4.7.
This is our 27th release on CD-ROM (and 28th via FTP).  We remain
proud of OpenBSD's record of more than ten years with only two remote
holes in the default install.

As in our previous releases, 4.7 provides significant improvements,
including new features, in nearly all areas of the system:

 - New/extended platforms:
    o OpenBSD/alpha
      o Added support for the DS15/DS25/ES45.
    o OpenBSD/loongson
      New platform for systems based on the Loongson 2E and 2F MIPS-compatible
      processors. Supported machines include:
      o Lemote Fuloong 2F mini-PC
      o Lemote Lynloong all-in-one-PC
      o Lemote Yeeloong netbook (8.9" and 10.1" models)
      o EMTEC Gdium Liberty 1000 netbook
    o OpenBSD/sgi
      o Added support for multi-node SGI Origin systems, in M mode.
      o Added support for the SGI Origin 350, Onyx 350, Onyx 4 and
        Tezro systems.
      o Added SMP support on the SGI Octane.
      o Support for many more onboard devices on Octane and Origin systems.
    o OpenBSD/socppc
      o Added support for the RouterBOARD RB600A.
    o OpenBSD/sparc64
      o Preliminary support for running OpenBSD in a guest domain on top of
        an OpenBSD control domain on sun4v machines.

 - Improved hardware support, including:
    o Revamped SCSI midlayer and improved driver support.
    o UDF 2.5 and 2.6 (HDDVD and Blu-ray) disks support.
    o Added mpath(4), a driver that steals paths to scsi devices if they could
      be available via multiple paths and then made available via mpath(4).
    o New aibs(4) driver for ASUSTeK AI Booster hardware monitoring.
    o New uthum(4) driver for the TEMPerHUM USB temperature and humidity
      sensors.
    o New utrh(4) driver for USBRH temperature and humidity sensors.
    o New uyurex(4) driver for the Maywa-denki & KAYAC YUREX twitch/jiggle of
      knee sensor.
    o New urndis(4) driver for remote NDIS Ethernet over USB devices (phones).
    o New xf86-video-wsudl(4) Xorg driver for USB DisplayLink devices
      supported by udl(4).
    o New mpii(4) driver for LSI Logic Fusion MPT Message Passing Interface II
      based SAS 2 controllers.
    o New athn(4) driver for Atheros IEEE 802.11a/g/n wireless network devices.
    o New alc(4) driver for Atheros AR8131/AR8132 10/100/Gigabit Ethernet
      devices.
    o New lisa(4) driver for STMicroelectronics LIS331DL MEMS motion sensors.
    o New gcu(4) driver for Intel EP80579 Global Configuration Unit.
    o New lom(4) driver for LOMLite and LOMLite2 as found on many of Sun's
      UltraSPARC-IIi servers.
    o New vsw(4) driver for virtual switches on sun4v machines.
    o New vds(4) driver for virtual disk servers on sun4v machines.
    o Support for EP80579 integrated Ethernet and ICH9 M V has been added
      to em(4).
    o Support for 82599 and SFP+ 82598 devices has been added to ix(4).
    o Support for the Sun GigabitEthernet SBus Adapter 1.0/1.1 has been
      added to ti(4).
    o Support for SBus variants of the QLogic Fibre Channel host adapters
      has been added to isp(4).
    o Support for SBus variants of the Sun Gigabit Ethernet has been added
      to gem(4).
    o Support for Intel WiFi Link 1000 and Intel Centrino
      Advanced-N 6200/Ultimate-N 6300 has been added to iwn(4).
    o Support for Ralink RT3572 based 802.11n devices has been added to run(4).
    o VIA Tremor 5.1, M-Audio Revolution 5.1 cards has been added to envy(4).
    o New uhts(4) driver for USB HID touchscreens.
    o Improved touchscreen support in the xf86-input-ws(4) Xorg driver and
      improved calibration using the new device properties from Xinput.
    o Support for ON CAT6095 and ON CAT34TS02 temperature sensors added
      to sdtemp(4).
    o Several improvements and bug fixes to existing Ethernet drivers,
      including em(4), re(4), ti(4) and vge(4).
    o Support for the PIC PCI-X controller added to the SGI xbridge(4) driver.
    o Support for the onboard Fast Ethernet interface found on SGI Octane
      and many SGI Origin family systems, iec(4).
    o Support for more SGI input and video devices on Octane and Origin
      systems, with iockbc(4), impact(4), and odyssey(4).
    o Improved PCI resource allocation; more hardware left unconfigured by
      the machine's firmware (including hotplugged hardware) should work now.
    o Support for recording/full-duplex added to mavb(4).
    o Improved support for USB audio devices in uaudio(4).
    o Improved support for bwi(4) devices on strict-alignment architectures
      like armish.
    o Eliminate usage of SCSI tagged queueing mechanisms other than simple
      queuing, thus avoiding incorrect implementations on various disk devices.
    o Eliminate spurious dhclient(8) error messages when the specified
      interface does not exist.
    o Eliminate spurious softraid(4) error messages for removable devices
      without media.

 - New tools:
    o newfs_ext2fs(8) for creating ext2 filesystems.
    o mkuboot(8) for creating U-Boot boot loader images.
    o midicat(1) MIDI server allowing MIDI programs to communicate
    o POSIX-compliant fuser(1) to identify process IDs holding a file open

 - Filesystem midlayer improvements:
    o Dynamic Buffer Cache now supported to a max size set with sysctl
      kern.bufcachepercent
    o Dynamic VFS name cache rewrite, now uses Red/Black trees instead of
      linked lists.
    o Numerous NFS client stability fixes.
    o Fix FAT32 mounting.
    o Fix cd9660 directory handling to eliminate looping and random
      truncation of directory entries.
    o Fix various internal locking problems with cd9660, udf, msdosfs
      and ffs file systems.

 - pf(4) improvements:
    o nat-to, rdr-to, binat-to options replace the nat, rdr and binat
      translation rules.
      changes for more info.
    o The route-to, reply-to, dup-to and fastroute options in pf.conf
      move to filteropts.
    o pf(4) can now translate packets between different routing domains.
    o Added -S and -L options to pfctl(8) to store and load pf state table
      from a file.
    o Added support for IPV4 and IPv6 divert sockets.

 - OpenBGPD, OpenOSPFD and other routing daemon improvements:
    o Update capability code in bgpd(8) to follow RFC 5492.
    o BGP MPLS VPN (RFC 4364) support added to the bgpd RIB.
    o In bgpd(8), implement the RFC4486 BGP Cease Notification
      Message subcodes.
    o It is now possible to enable/disable specific BGP capabilities.
    o Update bgpctl(8) irrfilter to support IPv6 and 4-byte AS numbers.
    o Minimal router-dead-time of 1 second and sub-second hello intervals
      added to ospfd(8). Additionally it is now possible to specify
      sub-second SPF timers for faster route fail-over.
    o ospf6d(8) is now installed by default. The RIB can be synced with
      the kernel routing table now. Support for AS-ext LSA has been added.
      This is still work-in-progress but testing is highly appreciated.
    o ldpd -- the MPLS label distribution protocol daemon -- is now
      installed by default. A custom kernel with option MPLS is needed
      to use it.

 - Generic network stack improvements:
    o brconfig is now integrated into ifconfig(8)
    o Added vether(4), a virtual Ethernet device.
    o Two bugs in IPsec/HMAC-SHA2 were fixed, resulting in an incompatibility
      with the HMAC-SHA-256/384/512 hash algorithms with previous versions
      of OpenBSD and other IPsec implementations sharing the bugs.
    o In dhcpd(8), echo back the Relay Agent Information option if present,
      and add support for the ipsec-tunnel hardware type.
    o Make dhcrelay(8) pick up the routing domain from the specified interface
      and use that rdomain for relaying the packets to the server.
    o Added support in dhcrelay(8) for RFC3046 "DHCP-over-ipsec".
    o Make the tcpdump(8) BGP OPEN capability parser RFC 5492 compliant.
    o Added an exec command to route(8) to run a process and its children
      in a specified routing domain.
    o ifconfig(8) now deals with more than 64 alias addresses.
    o Various fixes to mbuf defragmenting and mbuf chain copying
      improve reliability.

 - Assorted improvements:
    o malloc(3) now has an S flag to turn on the options that help debugging
      and improve security.
    o Updated terminfo(3) database and ncurses(3) library.
    o Added support for lazy binding in ld.so(1) on hppa.
    o Added POSIX silent check option (-C) to sort(1).
    o Added POSIX extended regular expression support to sed(1) (-E option).
    o Added GNU-compatible macro prefix option (-P) to m4(1).
    o Make it possible to specify a port in resolv.conf(5).
    o Improved FILE locking support in stdio(3).
    o Added SO_SNDTIMEO and SO_RCVTIMEO support in pthreads(3).
    o cdio(1) no longer prints bogus information if no TOC is found on
      the disk.
    o New -v flag causes cdio(1) to print profile and feature information.
    o whois(1) no longer attempts to keep the memory of 6Bone alive.
    o Added per-application MIDI-controlled volume knob to aucat(1)
    o Added MMC and MTC support to aucat(1) making possible MIDI-to-audio
      synchronization.
    o Added mio_open(3) interface to access hardware and software MIDI ports
    o Many memory leaks found by parfait and eliminated.
    o Make handling of floppy disk disklabels more reliable by properly
      initializing starting label.

 - Install/Upgrade process changes:
    o Take more care to ensure all filesystems are umount'ed when restarting
      an install or upgrade.
    o If no possible root disk is found, keep checking until one appears.
    o The default ftp directory for -stable is now the release directory
      instead of the snapshot directory.
    o Selection of TZ during installs is no longer confused by
      trailing slashes.
    o If /etc/X11 is found during upgrades, add the X sets to the list
      of default sets to install.

 - OpenSSH 5.5:
    o New features:
      o SSH protocol 1 is disabled by default.
      o Remove the libsectok/OpenSC-based smartcard code and add support
        for PKCS#11 tokens.
      o Add support for certificate authentication of users and hosts
        using a new, minimal OpenSSH certificate format (not X.509).
      o Added a 'netcat mode' to ssh(1).
      o Add the ability to revoke keys in sshd(8) and ssh(1).
      o Rewrite the ssh(1) multiplexing support to support non-blocking
        operation of the mux master.
      o Add a 'read-only' mode to sftp-server(8) that disables open in
        write mode and all other fs-modifying protocol methods. (bz#430)
      o Allow setting an explicit umask on the sftp-server(8) commandline
        to override whatever default the user has. (bz#1229)
      o Many improvements to the sftp(1) client.
      o New RSA keys will be generated with a public exponent of 65537
        instead of the previous value 35.
      o Passphrase-protected SSH protocol 2 private keys are now protected
        with AES-128 instead of 3DES.
    o The following significant bugs have been fixed in this release:
      o Fixed a minor information leak of environment variables specified in
        authorized_keys if an attacker happens to know the public key in use.
      o When using ChrootDirectory, make sure we test for the existence of
        the user's shell inside the chroot and not outside. (bz#1679)
      o Cache user and group name lookups in sftp-server using
        user_from_[ug]id(3) to improve performance on hosts where these
        operations are slow. (bz#1495)
      o Fix problem that prevented passphrase reading from being interrupted
        in some circumstances. (bz#1590)
      o Ignore and log any Protocol 1 keys where the claimed size is not
        equal to the actual size.
      o Make HostBased authentication work with a ProxyCommand. (bz#1569)
      o Avoid run-time failures when specifying hostkeys via a relative path
        by prepending the current working directory in these cases. (bz#1290)
      o Do not prompt for a passphrase if we fail to open a keyfile, and log
        the reason why the open failed to debug. (bz#1693)
      o Document that the PubkeyAuthentication directive is allowed in a
        sshd_config(5) Match block. (bz#1577)
      o When converting keys, truncate key comments at 72 chars as per
        RFC4716. (bz#1630)
      o Do not allow logins if /etc/nologin exists but is not readable by
        the user logging in.
      o Output a debug log if sshd(8) can't open an existing
        authorized_keys. (bz#1694)
      o Quell tc[gs]etattr(3) warnings when forcing a tty (ssh -tt), since
        we usually don't actually have a tty to read/set. (bz#1686)
      o Prevent sftp(1) from crashing when given a "-" without a command;
        also, allow whitespace to follow a "-". (bz#1691)
      o After sshd(8) receives a SIGHUP, ignore subsequent HUPs while
        sshd(8) re-execs itself; prevents two HUPs in quick succession
        from resulting in sshd(8) dying. (bz#1692)
      o Clarify in sshd_config(5) that StrictModes does not apply to
        ChrootDirectory; permissions and ownership are always checked
        when chrooting. (bz#1532)
      o Set close-on-exec on various descriptors so they don't get leaked
        to child processes. (bz#1643)
      o Fix very rare race condition in x11/agent channel allocation
      o Fix incorrect exit status when multiplexing and channel ID 0 is
        recycled. (bz#1570)
      o Fail with an error when an attempt is made to connect to a server
        with ForceCommand=internal-sftp with a shell session. (bz#1606)
      o Warn but do not fail if stat(2)ing the subsystem binary
        fails. (bz#1599)
      o Change "Connecting to host..." message to "Connected to host." and
        delay it until after the sftp protocol connection has been
        established. (bz#1588)
      o Use the HostKeyAlias rather than the hostname specified on the
        commandline when prompting for passwords. (bz#1039)
      o Correct off-by-one in percent_expand(). (bz#1607)
      o Fix passing of empty options from scp(1) and sftp(1) to the
        underlying ssh(1); also add support for the stop option "--".
      o Fix an incorrect magic number and typo in PROTOCOL. (bz#1688)
      o Don't escape backslashes when displaying the SSH2 banner. (bz#1533)
      o Don't unnecessarily dup() the in and out fds for
        sftp-server(8). (bz#1566)
      o Force use of the correct hash function for random-art signature
        display. (bz#1611)
      o Do not fall back to adding keys without constraints when the agent
        refuses the constrained add request. (bz#1612)
      o Fix a race condition in ssh-agent(1) that could result in a wedged
        or spinning agent. (bz#1633)
      o Flush stdio before exec() to ensure that everything has made it out
        before the streams go away. (bz#1596)
      o Set FD_CLOEXEC on in/out sockets in sshd(8). (bz#1706)

 - Over 5,800 ports, major robustness and speed improvements in package tools.
 - Many pre-built packages for each architecture:
    o i386: 5951
    o sparc64: 5745
    o alpha: 5641
    o sh: 768
    o amd64: 5879
    o powerpc: 5785
    o sparc: 4053
    o arm: 3711
    o hppa: 5500
    o vax: 1785
    o mips64: 3690
    o mips64el: 4316

 - Some highlights:
    o Gnome 2.28.2.
    o KDE 3.5.10.
    o Xfce 4.6.1.
    o MySQL 5.1.42.
    o PostgreSQL 8.4.2.
    o Postfix 2.6.5.
    o OpenLDAP 2.3.43.
    o Mozilla Firefox 3.0.18 and 3.5.8.
    o Mozilla Thunderbird 2.0.0.23.
    o OpenOffice.org 3.1.1.
    o Emacs 21.4 and 22.3
    o Vim 7.2.267.
    o PHP 5.2.12.
    o Python 2.4.6, 2.5.4 and 2.6.3.
    o Ruby 1.8.6.369.

 - As usual, steady improvements in manual pages and other documentation.

 - The system includes the following major components from outside suppliers:
    o Xenocara (based on X.Org 7.4 with xserver 1.6.5 + patches,
      freetype 2.3.9, fontconfig 2.6.0, Mesa 7.4.2, xterm 250 and more)
    o Gcc 2.95.3 (+ patches) and 3.3.5 (+ patches)
    o Perl 5.10.1 (+ patches)
    o Our improved and secured version of Apache 1.3, with SSL/TLS
      and DSO support
    o OpenSSL 0.9.8k (+ patches)
    o Groff 1.15
    o Sendmail 8.14.3, with libmilter
    o Bind 9.4.2-P2 (+ patches)
    o Lynx 2.8.6rel.5 with HTTPS and IPv6 support (+ patches)
    o Sudo 1.7.2
    o Ncurses 5.7
    o Latest KAME IPv6
    o Heimdal 0.7.2 (+ patches)
    o Arla 0.35.7
    o Binutils 2.15 (+ patches)
    o Gdb 6.3 (+ patches)

If you'd like to see a list of what has changed between OpenBSD 4.6
and 4.7, look at

        http://www.OpenBSD.org/plus47.html

Even though the list is a summary of the most important changes
made to OpenBSD, it still is a very very long list.

------------------------------------------------------------------------
- SECURITY AND ERRATA --------------------------------------------------

We provide patches for known security threats and other important
issues discovered after each CD release.  As usual, between the
creation of the OpenBSD 4.7 FTP/CD-ROM binaries and the actual 4.7
release date, our team found and fixed some new reliability problems
(note: most are minor and in subsystems that are not enabled by
default).  Our continued research into security means we will find
new security problems -- and we always provide patches as soon as
possible.  Therefore, we advise regular visits to

        http://www.OpenBSD.org/security.html
and
	http://www.OpenBSD.org/errata.html

Security patch announcements are sent to the security-announce@OpenBSD.org
mailing list.  For information on OpenBSD mailing lists, please see:

	http://www.OpenBSD.org/mail.html

------------------------------------------------------------------------
- CD-ROM SALES ---------------------------------------------------------

OpenBSD 4.7 is also available on CD-ROM.  The 3-CD set costs $50 CDN and
is available via mail order and from a number of contacts around the
world.  The set includes a colourful booklet which carefully explains the
installation of OpenBSD.  A new set of cute little stickers is also
included (sorry, but our FTP mirror sites do not support STP, the Sticker
Transfer Protocol).  As an added bonus, the second CD contains an audio
track, a song entitled "I'm still here".  MP3 and OGG versions of
the audio track can be found on the first CD.

Lyrics (and an explanation) for the songs may be found at:

    http://www.OpenBSD.org/lyrics.html#47

Profits from CD sales are the primary income source for the OpenBSD
project -- in essence selling these CD-ROM units ensures that OpenBSD
will continue to make another release six months from now.

The OpenBSD 4.7 CD-ROMs are bootable on the following four platforms:

  o i386
  o amd64
  o macppc
  o sparc64

(Other platforms must boot from floppy, network, or other method).

For more information on ordering CD-ROMs, see:

        http://www.OpenBSD.org/orders.html

The above web page lists a number of places where OpenBSD CD-ROMs
can be purchased from.  For our default mail order, go directly to:

        https://https.OpenBSD.org/cgi-bin/order

All of our developers strongly urge you to buy a CD-ROM and support
our future efforts.  Additionally, donations to the project are
highly appreciated, as described in more detail at:

        http://www.OpenBSD.org/goals.html#funding

------------------------------------------------------------------------
- OPENBSD FOUNDATION ---------------------------------------------------

For those unable to make their contributions as straightforward gifts,
the OpenBSD Foundation (http://www.openbsdfoundation.org) is a Canadian
not-for-profit corporation that can accept larger contributions and
issue receipts.  In some situations, their receipt may qualify as a
business expense writeoff, so this is certainly a consideration for
some organizations or businesses.  There may also be exposure benefits
since the Foundation may be interested in participating in press releases.
In turn, the Foundation then uses these contributions to assist OpenBSD's
infrastructure needs.  Contact the foundation directors at
directors@openbsdfoundation.org for more information.

------------------------------------------------------------------------
- T-SHIRT SALES --------------------------------------------------------

The OpenBSD distribution companies also sell tshirts and polo shirts.
And our users like them too.  We have a variety of shirts available,
with the new and old designs, from our web ordering system at, as
described above.

The OpenBSD 4.7 t-shirts are available now.  We also sell our older
shirts, as well as a selection of OpenSSH t-shirts.

------------------------------------------------------------------------
- FTP INSTALLS ---------------------------------------------------------

If you choose not to buy an OpenBSD CD-ROM, OpenBSD can be easily
installed via FTP.  Typically you need a single small piece of boot
media (e.g., a boot floppy) and then the rest of the files can be
installed from a number of locations, including directly off the
Internet.  Follow this simple set of instructions to ensure that
you find all of the documentation you will need while performing
an install via FTP.  With the CD-ROMs, the necessary documentation
is easier to find.

1) Read either of the following two files for a list of ftp
   mirrors which provide OpenBSD, then choose one near you:

        http://www.OpenBSD.org/ftp.html
        ftp://ftp.OpenBSD.org/pub/OpenBSD/4.7/ftplist

   As of May 19, 2010, the following ftp mirror sites have the 4.7 release:

	ftp://ftp.eu.openbsd.org/pub/OpenBSD/4.7/	Stockholm, Sweden
	ftp://ftp.bytemine.net/pub/OpenBSD/4.7/         Oldenburg, Germany
	ftp://mirror.aarnet.edu.au/pub/OpenBSD/4.7/     Brisbane, Australia
	ftp://ftp.wu-wien.ac.at/pub/OpenBSD/4.7/        Vienna, Austria
	ftp://ftp.usa.openbsd.org/pub/OpenBSD/4.7/	CO, USA
	ftp://ftp5.usa.openbsd.org/pub/OpenBSD/4.7/	CA, USA
	ftp://obsd.cec.mtu.edu/pub/OpenBSD/4.7/         Michigan, USA

	The release is also available at the master site:

	ftp://ftp.openbsd.org/pub/OpenBSD/4.7/	        Alberta, Canada

	However it is strongly suggested you use a mirror.

   Other mirror sites may take a day or two to update.

2) Connect to that ftp mirror site and go into the directory
   pub/OpenBSD/4.7/ which contains these files and directories.
   This is a list of what you will see:

        ANNOUNCEMENT     armish/          mvme68k/         sparc64/
        Changelogs/      ftplist          mvme88k/         src.tar.gz
        HARDWARE         hp300/           packages/        sys.tar.gz
        PACKAGES         hppa/            ports.tar.gz     tools/
        PORTS            i386/            root.mail        vax/
        README           landisk/         sgi/             xenocara.tar.gz
        alpha/           mac68k/          socppc/          zaurus/
        amd64/           macppc/          sparc/

   It is quite likely that you will want at LEAST the following
   files which apply to all the architectures OpenBSD supports.

        README          - generic README
        HARDWARE        - list of hardware we support
        PORTS           - description of our "ports" tree
        PACKAGES        - description of pre-compiled packages
        root.mail       - a copy of root's mail at initial login.
			  (This is really worthwhile reading).

3) Read the README file.  It is short, and a quick read will make
   sure you understand what else you need to fetch.

4) Next, go into the directory that applies to your architecture,
   for example, i386.  This is a list of what you will see:

	INSTALL.i386    cd47.iso        floppyB47.fs    pxeboot*
	INSTALL.linux   cdboot*         floppyC47.fs    xbase47.tgz
	MD5             cdbr*           game47.tgz      xetc47.tgz
	base47.tgz      cdemu47.iso     index.txt       xfont47.tgz
	bsd*            comp47.tgz      install47.iso   xserv47.tgz
	bsd.mp*         etc47.tgz       man47.tgz       xshare47.tgz
	bsd.rd*         floppy47.fs     misc47.tgz

   If you are new to OpenBSD, fetch _at least_ the file INSTALL.i386
   and the appropriate floppy*.fs or install47.iso files.  Consult the
   INSTALL.i386 file if you don't know which of the floppy images
   you need (or simply fetch all of them).

   If you use the install47.iso file (roughly 200MB in size), then you
   do not need the various *.tgz files since they are contained on that
   one-step ISO-format install CD.

5) If you are an expert, follow the instructions in the file called
   README; otherwise, use the more complete instructions in the
   file called INSTALL.i386.  INSTALL.i386 may tell you that you
   need to fetch other files.

6) Just in case, take a peek at:

        http://www.OpenBSD.org/errata.html

   This is the page where we talk about the mistakes we made while
   creating the 4.7 release, or the significant bugs we fixed
   post-release which we think our users should have fixes for.
   Patches and workarounds are clearly described there.

Note: If you end up needing to write a raw floppy using Windows,
      you can use "fdimage.exe" located in the pub/OpenBSD/4.7/tools
      directory to do so.

------------------------------------------------------------------------
- X.ORG FOR MOST ARCHITECTURES -----------------------------------------

X.Org has been integrated more closely into the system.  This release
contains X.Org 7.4.  Most of our architectures ship with X.Org, including
amd64, sparc, sparc64 and macppc.  During installation, you can install
X.Org quite easily.  Be sure to try out xdm(1) and see how we have
customized it for OpenBSD.

------------------------------------------------------------------------
- PORTS TREE -----------------------------------------------------------

The OpenBSD ports tree contains automated instructions for building
third party software.  The software has been verified to build and
run on the various OpenBSD architectures.  The 4.7 ports collection,
including many of the distribution files, is included on the 3-CD
set.  Please see the PORTS file for more information.

Note: some of the most popular ports, e.g., the Apache web server
and several X applications, come standard with OpenBSD.  Also, many
popular ports have been pre-compiled for those who do not desire
to build their own binaries (see BINARY PACKAGES, below).

------------------------------------------------------------------------
- BINARY PACKAGES WE PROVIDE -------------------------------------------

A large number of binary packages are provided.  Please see the PACKAGES
file (ftp://ftp.OpenBSD.org/pub/OpenBSD/4.7/PACKAGES) for more details.

------------------------------------------------------------------------
- SYSTEM SOURCE CODE ---------------------------------------------------

The CD-ROMs contain source code for all the subsystems explained
above, and the README (ftp://ftp.OpenBSD.org/pub/OpenBSD/4.7/README)
file explains how to deal with these source files.  For those who
are doing an FTP install, the source code for all four subsystems
can be found in the pub/OpenBSD/4.7/ directory:

        xenocara.tar.gz     ports.tar.gz   src.tar.gz     sys.tar.gz

------------------------------------------------------------------------
- THANKS ---------------------------------------------------------------

Ports tree and package building by Jasper Lievisse Adriaanse, Michael Erdely,
Simon Bertrang, Stuart Henderson, Antoine Jacoutot, Robert Nagy,
Nikolay Sturm, and Christian Weisgerber.  System builds by Theo de Raadt,
Mark Kettenis, and Miod Vallat.  X11 builds by Todd Fries and Miod Vallat.
ISO-9660 filesystem layout by Theo de Raadt.

We would like to thank all of the people who sent in bug reports, bug
fixes, donation cheques, and hardware that we use.  We would also like
to thank those who pre-ordered the 4.7 CD-ROM or bought our previous
CD-ROMs.  Those who did not support us financially have still helped
us with our goal of improving the quality of the software.

Our developers are:

    Alexander Bluhm, Alexander Hall, Alexander von Gernler,
    Alexander Yurchenko, Alexandre Ratchov, Alexey Vatchenko,
    Anders Magnusson, Andreas Gunnarsson, Anil Madhavapeddy,
    Antoine Jacoutot, Ariane van der Steldt, Artur Grabowski,
    Austin Hook, Benoit Lecocq, Bernd Ahlers, Bob Beck, Bret Lambert,
    Can Erkin Acar, Chad Loder, Charles Longeau, Chris Kuethe,
    Christian Weisgerber, Claudio Jeker, Dale Rahn, Damien Bergamini,
    Damien Miller, Dariusz Swiderski, Darren Tucker,
    David Gwynne,  David Hill, David Krause, Edd Barrett, Eric Faurot,
    Esben Norby,  Fabien Romano, Federico G. Schwindt, Felix Kronlage,
    Gilles Chehade, Giovanni Bechis, Gordon Willem Klok,
    Henning Brauer, Ian Darwin, Igor Sobrado, Ingo Schwarze,
    Jacek Masiulaniec, Jacob Meuser, Jakob Schlyter, Janne Johansson,
    Jared Yanovich, Jason Dixon, Jason George, Jason McIntyre,
    Jason Meltzer, Jasper Lievisse Adriaanse, Jim Razmus II, Joel Sing,
    Joerg Goltermann, Johan Mson Lindman, Jolan Luff, Jonathan Armani,
    Jonathan Gray, Jordan Hargrave, Joshua Stein, Kenneth R Westerback,
    Kevin Lo, Kevin Steves, Kjell Wooding, Kurt Miller, Landry Breuil,
    Laurent Fanis, Marc Espie, Marco Peereboom, Marco Pfatschbacher,
    Marco S Hyman, Marcus Glocker, Marek Vasut, Mark Kettenis,
    Mark Uemura, Markus Friedl, Martin Reindl, Martynas Venckus,
    Mathieu Sauve-Frankel, Mats O Jansson, Matthias Kilian,
    Matthieu Herrb, Michael Erdely, Michael Knudsen, Michele Marchetto,
    Mike Larkin, Miod Vallat, Moritz Grimm, Moritz Jodeit,
    Nicholas Marriott, Nick Holland, Nikolay Sturm, Okan Demirmen,
    Oleg Safiullin, Otto Moerbeek, Owain Ainsworth, Paul de Weerd,
    Paul Irofti, Peter Hessler, Peter Stromberg, Peter Valchev,
    Philip Guenther, Pierre-Emmanuel Andre, Pierre-Yves Ritschard,
    Rainer Giedat, Reyk Floeter, Robert Nagy, Rui Reis,
    Ryan Thomas McBride, Simon Bertrang, Simon Perreault, Stefan Kempf,
    Stefan Sperling, Stephan A. Rickauer, Steven Mestdagh,
    Stuart Henderson, Takuya Asada, Ted Unangst, Theo de Raadt,
    Thordur I Bjornsson, Tobias Stoeckmann, Tobias Weingartner,
    Todd C. Miller, Todd Fries, Will Maier, William Yodlowsky,
    Xavier Santolaria, Yasuoka Masahiko, Yojiro Uo

I’m the happay owner of a Huawei E1750 modem and it is real easy to get it running in Ubuntu. This guide will probably work with many other 3G USB modems.

Just type from the command line:

sudo apt-get install usb-modeswitch

Plug in the modem

Go to the Network manager and enter your Mobile Broadband credentials and now it works!

I wanted to unlock my operator locked Huawei e1750 modem. After googling I found this page in swedish.

The unlock code can be calculated by using the IMEI number, the unlock code is sent by using AT commands.

I have succesfully tested this on e1750 and e1550.

I also tried it on e220 and it did not work.

1. Get the IMEI number

Normally this is printed on the device put the geek way of getting it is by asking the device:

peter@peter-laptop:~/huawei$ cat /dev/ttyUSB0 &
[1] 9378
peter@peter-laptop:~/huawei$ echo -e "ATI\r" > /dev/ttyUSB0
peter@peter-laptop:~/huawei$ ATI
Manufacturer: huawei
Model: E1750
Revision: 11.126.07.04.00
IMEI: 123456789012347
+GCAP: +CGSM,+DS,+ES

OK

So the IMEI number is: 123456789012347

2. Calculate the unlock code

The following python script will calculate the unlock code:

import hashlib

def getCode(imei, salt):
    digest = hashlib.md5((imei+salt).lower()).digest()
    code = 0
    for i in range(0,4):
        code += (ord(digest[i])^ord(digest[4+i])^ord(digest[8+i])^ord(digest[12+i])) << (3-i)*8
        code &= 0x1ffffff
        code |= 0x2000000
    return code

# Your IMEI goes here:
imei = "123456789012347"

print "Unlock code: %s" % getCode(imei, "5e8dd316726b0335")
print "Flash code: %s" % getCode(imei, "97b7bc6be525ab44")

When run:

peter@peter-laptop:~/huawei$ python unlock_code.py
Unlock code: 36963763
Flash code: 53969249

3. Use the unlock code

peter@peter-laptop:~/huawei$ echo -e 'AT^CARDLOCK="36963763"\r' > /dev/ttyUSB0

OK

Congratulations, now your modem is unlocked

With my new and fancy HTC Desire I wanted to look at my Nagios or op5 Monitor status. I have found two apps Nagroid and NagMonDroid.

NagMonDroid did I not get working, probably because op5 Monitor only uses https as protocol.

Nagroid works like a charm:

The configuration is rather straightforward:

I bought a Fonera 2.0g WLAN router and I wanted to extend the functionality to have the possibility to add packages from OpenWRT. I also wanted the possibility to manage my new router with ssh.

The way to achive this is by installing developer firmware.

Installing

I followed the instructions at Fons beta/developer wiki.

The image I used can be found here.

Test

I try to connect by using ssh

peter@peter-laptop:~$ ssh -l root 192.168.10.1
root@192.168.10.1's password: 

BusyBox v1.11.1 (2009-04-17 12:45:57 CEST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

                                        __
                                    _.-~  )
                         _..--~~~~,'   ,-/     _
                      .-'. . . .'   ,-','    ,' )
                    ,'. . . _   ,--~,-'__..-'  ,'
                  ,'. . .  (@)' ---~~~~      ,'
                 /. . . . '~~             ,-'
                /. . . . .             ,-'
               ; . . . .  - .        ,'
              : . . . .       _     /
             . . . . .          `-.:
            . . . ./  - .          )
           .  . . |  _____..---.._/ ____ Seal _
     ~---~~~~----~~~~             ~~                

                      Flipper                       

--------  Fonera 2.0 Firmware (v2.2.5.0) -----------
      * Based on OpenWrt - http://openwrt.org
      * Powered by FON - http://www.fon.com
----------------------------------------------------

After some Google search and reading of man pages I finally get it working.

My setup is a Nokia E52 and a IBM T60 laptop running Ubuntu 9.10. I have tested it with a Ericsson P1i and a Dell D630 aswell and I think the guidlines below will work with many other setups. One exception is probably iPhone

From a bash shell run:

peter@svarten:~$ sdptool search DUN
Inquiring ...
Searching for DUN on A8:7E:33:20:40:0F ...
Service Name: Dial-Up Networking
Service RecHandle: 0x10030
Service Class ID List:
  "Dialup Networking" (0x1103)
Protocol Descriptor List:
  "L2CAP" (0x0100)
  "RFCOMM" (0x0003)
    Channel: 5
Language Base Attr List:
  code_ISO639: 0x454e
  encoding:    0x6a
  base_offset: 0x100
Profile Descriptor List:
  "Dialup Networking" (0x1103)
    Version: 0x0100

peter@svarten:~$ sudo rfcomm connect 1 A8:7E:33:20:40:0F 5
[sudo] password for peter:
Connected /dev/rfcomm1 to A8:7E:33:20:40:0F on channel 5
Press CTRL-C for hangup

Now my phone asks if I accept the connection and I choose "yes".

And now the networkmanager has a new "Mobile Broadband connection". Just choose your operator and it will work.

I registered on their homepage and after a couple of days I got a snail mail with my credentials.

I configured my FreePBX and calling in worked directly, but not outgoing. After 2 hours of troubleshooting I started to google "phonzo asterisk" and found several people that has the same experience. The reason is that Phonzo does not accepted "Asterisk PBX" as useragent and that is default in Asterisk.

After changing sip.conf

[general]

...

useragent=it-slav PBX

....

It worked!

I do not like unlogical stupidity so I sent an email to the support and the following bizare mail conversation occoured:

I will update this post when new info arrives.

I was reading the Swedish computer magazine, Tech World. There was an article about an appliance solution that could give a report about unused switch ports. The box PortIQ from Infoblox costs approximatly 10.000 Euro.

op5 has developed this feature at a customer site and is included with op5 Monitor, op5 has published the code as opensource.

This guide will describe howto get it running in op5 Monitor. op5 Monitor is vanilla Nagios with some addons so it should be no problem to follow this guide in a Nagios environment

Installation

1. Update your op5 Monitor or download the plugin and report script.

2. Create metadata for check_portstatus as $USER1$/check_portstatus -H $HOSTADDRESS$

in checkcommands.cfg:

# command 'check_portstatus'
define command{
    command_name                   check_portstatus
    command_line                   $USER1$/check_portstatus -H $HOSTADDRESS$
    }
 

3. mkdir /var/spool/check_portstatus

4. chown monitor:apache /var/spool/check_portstatus

5. cp /opt/monitor/op5/portstatus/portstatus.php /var/www/html/portstatus.php

6. Define your service i.e. services.cfg:

# service 'Portstatus'
define service{
    use                            default-service
    host_name                      gw
    service_description            Portstatus
    check_command                  check_portstatus
    }
 

The result

The screenshot below shows a Cisco switch with alot of unused ports.

Conclusions

This article shows how easy it is to modify Nagios and other opensource tools to give you what you want. Do not hesitate to contact me or op5 to help you enhance you Nagios or op5 installation.

Links

• op5
• op5 Monitor
• Nagios
• PortIQ appliance box from Infoblox
• Tech world

This article will describe how easy it is to integrate other tools to Nagios or op5 Monitor. I will use an example with a webshop where a business view of how the webshop is doing is implemented by using a GPL’d rule engine, NodeBrain. I have in an earlier article described the ruleset for this implementation but now I will show how the integration can be done.

Scenario

The scenario is a webshop with:

• 5 frontend webservers
• 2 application servers
• 3 databasservers

Management want to monitor how the webshop is doing. They do not want to know if a redundant part is down instead management want to have the overview of the webshop status.

A management consultant is hired and do an investigation and after a ridiculous amount of money the following rules are defined:

• Webserver rules
  • If 3 or more webserver works the webservice is OK
  • If 2 webservers works the webservice is WARNING
  • If 1 webserver or less is working the webservice is CRITICAL
• Applicationserver rules
  • If 1 or 2 application servers works the application layer is OK
  • If zero application servers works the application layer is CRITICAL
• Database server rules
  • If 2 or more database server works the database layer is OK
  • if 1 database server works the database layer is WARNING
  • If no database servers works the database layer is CRITICAL
•  The webserver layer, application layer and database layer should be viewed seperatly
• The total webshop status has the highest status value of webserver layer, application layer and database layer

I use Nagvis to illustrate the releationship between the layers.

Case 1

The picture shows when everything is fine:

Case 2

The rules in place:

• 2 webservers CRITICAL and the webserverlayer is OK
• 1 appserver CRITICAL and the application layer is OK
• 2 databases are down and the database layer is WARNING
• The total webshop status is WARNING because it has the highest status of the different layers

Case 3

Now it has been even worse:

• 4 webservers CRITICAL and the webserverlayer is CRITICAL
• 1 appserver CRITICAL and the application layer is OK
• 2 databases are down and the database layer is WARNING
• The total webshop status is CRITICAL because it has the highest status of the different layers

Conclusions

This article shows the power of Open Source and what is possible todo when integration different projects with each other. A solution like this with one of the Big Four (IBM, BMC, CA, HP) would have cost alot when it comes to license and highly specialised consultants had to be hirered.

Links

• Op5 A company that package and support enterprise class systems- and networkmanagement products
• NodeBrain, A powerful GPL’d rule engine
• Nagios, An enterprise class Monitoring sofware
• Nagvis, Nagios Visualization addon

Implementation

Hosts and services

The hosts and services are created:

• Webserver layer: 5 hosts each with 1 service
• Application layer: 2 hosts each with 1 service
• Database layer: 3 hosts each with 1 service
• Webshop layer: 1 host called webshopcontainer and 4 services: webserversstatus, appsserverstatus, dbserversstatus and webshop status. The services represent each layer in the model and webshop is the total status of the webshop.

To make it easy to control the status of all these devices I will use passive checks. So if I want to change the status of a service I just use the GUI and send in a passive check result. In real life active checks would have been used to monitor the different services.

The result showing Service Detail using op5 developed Nagios GUI Ninja:

The statechanges are sent to NodeBrain via an eventhandler that sends the NodeBrain commands via a namedpipe:

#!/bin/sh
#
# Event handler script for sending nagios data to nodebrain
#
# This script has these arguments $SERVICESTATEID$ $SERVICESTATETYPE$ $SERVICEATTEMPT$ $SERVICEDESC$ $HOSTNAME$
NODEBRAINPIPE=/opt/plugins/custom/nodebrainpipe
DATE=`date`
echo "$DATE SERVICESTATEID=$1 SERVICESTATETYPE=$2 SERVICEATTEMPT=$3 SERVICEDESC=$4 HOSTNAME=$5" >> /tmp/eventhandler_out

exit 0

The Nodebrainrules, that has all the logic and opens the namedpipe for commands:

#!/usr/local/bin/nb -d
#
-rm webshop.log
set log="webshop.log",out=".";
declare indata identity owner;
define webshop node pipe.server("indata@nodebrainpipe");

#Total rules
assert webshopstatus=0;
#If all serverstatus ok, the whole webshop is ok
define webshopok on(webserversstatus=0 and appserversstatus=0 and dbserversstatus=0) webshopstatus=0;
define webshopoksend on(webshopstatus=0):-./send_to_monitor.sh webshopstatus 0 "OK: Webshop is fine";
#If any serverstatus is critical the whole webshop is critical
define webshopscritical on(webserversstatus=2 or appserversstatus=2 or dbserversstatus=2) webshopstatus=2;
define webshopscriticalsend on(webshopstatus=2):-./send_to_monitor.sh webshopstatus 2 "CRITICAL: Webshop has serious problems";
#If not any serverstatuscritical and in warning, the whole shop is warning.
define webshopwarning on((!webserversstatus=2 and !appserversstatus=2 and !dbserversstatus=2) and (webserversstatus=1 or dbserversstatus=1)) webshopstatus=1;
define webshopwarningsend on(webshopstatus=1):-./send_to_monitor.sh webshopstatus 1 "WARNING: Webshop has some problems";
 

The NodeBrain rules runs this script when fired:

#!/bin/sh

HOSTNAME=webshopcontainer
SERVICEDESC=$1
STATUS=$2
MESSAGE=$3


now=`date +%s`
commandfile='/opt/monitor/var/rw/nagios.cmd'
/usr/bin/printf "[%lu] PROCESS_SERVICE_CHECK_RESULT;$HOSTNAME;$SERVICEDESC;$STATUS;$MESSAGE\n" $now > $commandfile

The Nagios or op5 Monitor hosts.cfg

###############################################################################
#  Generated by op5 Monitor webconfiguration exporter
#
#  Exported 2009-10-22 19:33 by monitor
#

# host 'webshopcontainer'
define host{
    use                            Dummy-template
    host_name                      webshopcontainer
    alias                          webshopcontainer
    address                        127.0.0.1
    contact_groups                 support-group
    }
 

The Nagios or op5 Monitor services.cfg

###############################################################################
#  Generated by op5 Monitor webconfiguration exporter
#
#  Exported 2009-10-22 19:33 by monitor
#

# service 'webshopstatus'
define service{
    use                            Dummy-service-template
    host_name                      webshopcontainer
    service_description            webshopstatus
    servicegroups                  webshop
    flap_detection_enabled         0
    }

Many people have received their 4.6 CDs in the mail by now, and we
really don't want them to be without the full package repository.

------------------------------------------------------------------------
- OpenBSD 4.6 RELEASED -------------------------------------------------

Oct 18, 2009.

We are pleased to announce the official release of OpenBSD 4.6.
This is our 26th release on CD-ROM (and 27th via FTP).  We remain
proud of OpenBSD's record of more than ten years with only two remote
holes in the default install.

As in our previous releases, 4.6 provides significant improvements,
including new features, in nearly all areas of the system:

- New/extended platforms:
    o mvme88k
      o MVME141 and MVME165 boards are now supported.
    o sgi
      o SGI Octane, SGI Origin 200 and SGI Fuel systems are now supported.
      o Several bugs in interrupt handling have been fixed, resulting
        in significantly improved system response.
    o sparc
      o The bootblock load address has been moved so that larger kernels
        can be loaded.
    o sparc64
      o Acceleration support has been added for many of the PCI frame buffer
        drivers, such as the Sun PGX, PGX64 and XVR-100, and Tech Source
        Raptor GFX graphics cards.

- Improved hardware support, including:
    o Several new/improved drivers for sensors, including:
      o The ips(4) driver now has sensor support, complementing the bio support.
      o The acpithinkpad(4) driver now has temperature and fan sensor support.
      o New endrun(4) driver for the EndRun Technologies timedelta sensor.
      o The fins(4) driver now has support for F71806, F71862 and F71882 ICs.
      o The acpitz(4) driver now shows correct decimals for temperature.
    o Added radeonfb(4) to sparc64, an accelerated framebuffer for
      Sun XVR-100 boards.
    o Added support for RTL8103E and RTL8168DP devices in the re(4) driver.
    o Added support for BCM5709/BCM5716 devices in the bnx(4) driver.
    o Added support for ICH10 variants of em(4).
    o Added support for VIA VX855 chipset in the viapm(4) and pciide(4) drivers.
    o Added support for Intel SCH IDE to pciide(4).
    o Added support for the Broadcom HT-1100 chipset in the piixpm(4) driver.
    o Added support for 82574L based devices in the em(4) driver.
    o Added support for VIA CX800 south bridge to the viapm(4) driver.
    o A number of network drivers including bge(4), bnx(4), hme(4), iwn(4),
      ix(4), msk(4), sis(4), sk(4), vr(4) and wpi(4) now make use of the
      MCLGETI(9) allocator in order to reduce memory usage and increase
      performance when under load or attack.
    o Added support in em(4) for the newer 82575 chips.
    o zyd(4) now supports devices with Airoha AL2230S radios.
    o zyd(4) now works on big-endian machines
    o urtw(4) now supports RTL8187B based devices.
    o New otus(4) driver for Atheros AR9001U USB 802.11a/b/g/Draft-N
      wireless devices.
    o New berkwdt(4) driver for Berkshire Products PCI watchdog timers.
    o New udl(4) driver for USB video devices.
    o Support for a variety of newer models in bge(4).
    o Initial version of vsw(4), a driver for the virtual network switch
      found on sun4v sparc64 systems.
    o Implemented machfb(4), an accelerated driver for the sparc64 PGX/PGX64
      framebuffers.
    o New vcc(4) and vcctty(4) drivers for the "Virtual Console Concentrator"
      found on the control domain of sun4v systems.
    o Implemented 64-bit FIFO modes for ciss(4) devices.
    o Enabled hardware VLAN tagging and stripping on ix(4).
    o Added basic support for Envy24HT chips to the envy(4) driver.
    o Many improvements and updates to the isp(4) driver.
    o Added support for 88E8057-based Yukon 2 Ultra 2-devices in msk(4).
    o The ips(4) driver now works reliably.
    o Added raptor(4), an accelerated framebuffer driver for the Tech Source
      Raptor GFX cards on the sparc64 platform.
    o Enabled schsio(4) on i386 and amd64 and added watchdog timer support.
    o New acpivideo(4) driver for ACPI display switching and brightness control.
    o Added support for the IBM ServeRAID-8k in the aac(4) driver.
    o Added support for the BCM5825 and 5860/61/62 Broadcom CryptoNetX
      IPSec/SSL Security processor in the ubsec(4) driver.
    o Added support for AES-CBC with BCM5823-based ubsec(4) devices.
    o Firmware for bnx(4) has been updated.
    o Added support to fxp(4) for the 82552 MAC found on some ICH7 chipsets.
    o Added support to umsm(4) for Truinstall enabled modems like the
      Sierra 881U.
    o Added support to pciide(4) for ICH10 SATA devices not operating in
      AHCI mode.
    o dc(4) now reads the MAC address from the eeprom rather than CIS.
    o em(4) now correctly handles MAC addresses for dual-port 8257[56] cards.
    o IPv6 receive TCP/UDP checksum offloading has been enabled for jme(4).
    o IPv6 receive TCP/UDP checksum offloading has been enabled in bge(4) for
      the 5755 and later chips.
    o iwi(4) now associates with APs that refuse non-short slot-time capable
      STAs.
    o IP, TCP and UDP checksum offloading has been enabled in vr(4) for
      VT6105M-based devices.
    o VGA BIOS repost support has been added for amd64 and i386 platforms.

- New tools:
    o Added smtpd(8), a new privilege-separated SMTP daemon.
    o Imported the tmux(1) terminal multiplexer, replacing window(1).

- New functionality:
    o httpd(8) can now serve files larger than 2GB in size.
    o Mice with many buttons are now supported by wsmoused(8).
    o New "nfsserver" and "nfsclient" views have been added to systat(1).
    o Automatic partition allocation has been added to disklabel(8), with a
      variety of smart heuristics.
    o An undo command has been added to disklabel(8), which reverts the
      label back to its previous state.
    o When running in auto-mode, sysmerge(8) will now install binary files
      from X sets automatically.
    o sysmerge(8) now creates a report summary file in the work directory.
    o httpd(8) now drops privileges to www/www rather than nobody/nogroup
      if the User/Group entries are not present within the configuration file.
    o ELF based platforms now generate ELF core dumps and gdb(1) is now able
      to read ELF core dumps.
    o Additional diff options have been added to opencvs(1).
    o When sendbug(1) is run as root, the pcidump(8) and acpidump(8) output
      is included.
    o Support for audible ping(8) and ping6(8) has been added.
    o ftpd(8) now logs both the remote IP and remote hostname when receiving
      a new connection.
    o relayd(8) now allows both UDP and TCP redirections.
    o SSL sessions are now maintained by relayd(8) for each checked host,
      resulting in subsequent checks being lighter and faster on the server.
    o Added support to relayd(8) for client-side TCP connections from relays.
    o Added support to relayd(8) for specifying a CA file to verify SSL server
      certificates when connecting as a client from relays.

- pf(4) improvements:
    o Enabled pf(4) by default in the rc.conf(8).
    o Removed pf(4) scrub rules, and only do one kind of packet reassembly.
      Rulesets with scrub rules need to be modified because of this.
    o Regular rules can now have per-rule scrub options.
    o Added new "match" keyword which only applies rule options but does
      not change the current pass/block state.
    o Make all pf(4) operations transactional to improve atomicity of reloads.
    o Stricter pf(4) checking for ICMP and ICMPv6 packets.
    o Various improvements to pfsync(4) to lower sync traffic bandwidth and
      optionally allow active-active firewall setups.
    o Fix pf(4) scrub max-mss for IPv6 traffic.

- softraid(4) improvements:
    o Rebuild support has been added and RAID 1 volumes can now be rebuilt.
    o Boot time assembly has been significantly improved, with volume and
      chunk ordering now being respected. Duplicated chunks and version
      mismatches are also handled gracefully.
    o Volumes with missing members are now brought online.

- OpenBGPD, OpenOSPFD and other routing daemon improvements:
    o In bgpd(8), rework most of the RDE to allow multiple RIBs.
      It is possible to filter per-RIB and attach neighbors to a specific RIB.
    o Added an option to bgpd(8) to change the "connect-retry" timer.
    o Allow bgpd.conf(5) and bgpctl(8) to contain 32-bit ASN numbers written in
      ASPLAIN format.
    o Fix bgpd(8) to correctly encode MP unreachable NLRI so IPv6 prefixes get
      removed correctly.
    o Changed the behaviour of "redistribute default" for ospfd(8) and ripd(8).
      A default route has to be present in the FIB to be correctly advertised.
    o Make ospfd(8) and ripd(8) track reject and blackhole routes and allow
      them to be redistributed even if pointing to 127.0.0.1.
    o Allow an alternate control socket to be specified for ospfd(8).
    o ospfd(8) can now be bound to an alternate routing domain.
    o Fix ospfd(8) route metric for "redistribute default".
    o Initial version of ldpctl(8) and ldpd(8), a label distribution protocol
      daemon for mpls.
    o Make dvmrpd(8) RDE aware of multicast group members per interface.
    o Added support for pruning in dvmrpd(8).

- Generic Network-Stack improvements:
    o Support for virtual routing and firewalling with the addition of routing
      domains.
    o Added support for ifconfig(8) to bind an interface to a routing domain.
    o Added support to ping(8), traceroute(8), arp(8), nc(1) and telnet(1) to
      specify which routing domain to use.
    o Allow ifconfig(8) to turn off IPv6 completely for an interface and
      make rtsold(8) turn on inet6 on the interface.
    o Routes track the interface link state.
    o route(8) flush accepts "-iface" or "-priority" to only flush routes
      matching these conditions.
    o Multiple dhclients can now coexist without causing mayhem.
    o Make wireless interfaces have an interface priority of 4 by default.
      Makes them less preferred then wired interfaces.
    o Do not accept IPv4 ICMP redirects by default.
    o Added the MAC address to the log entries in dhclient(8).
    o Make systat(1) show interface description names in the interface view,
      and add new NFS server and client views.
    o Make tun(4) emulate link state depending on the open and close of the
      device fd.
    o Use pf state-table information to speed up decision on whether a packet
      is to be delivered locally or forwarded.
    o More routing socket checks added to make userland applications more
      resilient to kernel changes.

- Install/Upgrade process changes:
    o The installer has almost been rewritten, primarily with a focus on
      simplifying the installation process.
    o Automatic disk layout can now be used during installation, allowing for
      simple single-disk installs.
    o VLAN support is now available in some installation media.
    o A standard user account can now be created during the install process.

- OpenSSH 5.3:
    o Do not limit home directory paths to 256 characters.
    o Several minor documentation and correctness fixes.

- Over 5,800 ports, minor robustness improvements in package tools.
    o Many pre-built packages for each architecture:
      i386:   5606    sparc64:  5413    alpha: 5346    sh:     1261
      amd64:  5544    powerpc:  5427    sparc: 3711    mips64: 3443
      arm:    5291    hppa:     4790    vax:   1785

- As usual, steady improvements in manual pages and other documentation.

- The system includes the following major components from outside
  suppliers:
      o Xenocara (based on X.Org 7.4 + patches, freetype 2.3.9,
        fontconfig 2.6.0, Mesa 7.4.2, xterm 243 and more)
      o Gcc 2.95.3 (+ patches) and 3.3.5 (+ patches)
      o Perl 5.10.0 (+ patches)
      o Our improved and secured version of Apache 1.3, with SSL/TLS
        and DSO support
      o OpenSSL 0.9.8k (+ patches)
      o Groff 1.15
      o Sendmail 8.14.3, with libmilter
      o Bind 9.4.2-P2 (+ patches)
      o Lynx 2.8.6rel.5 with HTTPS and IPv6 support (+ patches)
      o Sudo 1.7.2
      o Ncurses 5.2
      o Latest KAME IPv6
      o Heimdal 0.7.2 (+ patches)
      o Arla 0.35.7
      o Binutils 2.15 (+ patches)
      o Gdb 6.3 (+ patches)

If you'd like to see a list of what has changed between OpenBSD 4.5
and 4.6, look at

        http://www.OpenBSD.org/plus46.html

Even though the list is a summary of the most important changes
made to OpenBSD, it still is a very very long list.

------------------------------------------------------------------------
- SECURITY AND ERRATA --------------------------------------------------

we provide patches for known security threats and other important
issues discovered after each CD release.  As usual, between the
creation of the OpenBSD 4.6 FTP/CD-ROM binaries and the actual 4.6
release date, our team found and fixed some new reliability problems
(note: most are minor and in subsystems that are not enabled by
default).  Our continued research into security means we will find
new security problems -- and we always provide patches as soon as
possible.  Therefore, we advise regular visits to

        http://www.OpenBSD.org/security.html
and
	http://www.OpenBSD.org/errata.html

Security patch announcements are sent to the security-announce@OpenBSD.org
mailing list.  For information on OpenBSD mailing lists, please see:

	http://www.OpenBSD.org/mail.html

------------------------------------------------------------------------
- CD-ROM SALES ---------------------------------------------------------

OpenBSD 4.6 is also available on CD-ROM.  The 3-CD set costs $50 CDN and
is available via mail order and from a number of contacts around the
world.  The set includes a colourful booklet which carefully explains the
installation of OpenBSD.  A new set of cute little stickers is also
included (sorry, but our FTP mirror sites do not support STP, the Sticker
Transfer Protocol).  As an added bonus, the second CD contains an audio
track, a song entitled "Planet of the Users".  MP3 and OGG versions of
the audio track can be found on the first CD.

Lyrics (and an explanation) for the songs may be found at:

    http://www.OpenBSD.org/lyrics.html#46

Profits from CD sales are the primary income source for the OpenBSD
project -- in essence selling these CD-ROM units ensures that OpenBSD
will continue to make another release six months from now.

The OpenBSD 4.6 CD-ROMs are bootable on the following four platforms:

  o i386
  o amd64
  o macppc
  o sparc64

(Other platforms must boot from floppy, network, or other method).

For more information on ordering CD-ROMs, see:

        http://www.OpenBSD.org/orders.html

The above web page lists a number of places where OpenBSD CD-ROMs
can be purchased from.  For our default mail order, go directly to:

        https://https.OpenBSD.org/cgi-bin/order

All of our developers strongly urge you to buy a CD-ROM and support
our future efforts.  Additionally, donations to the project are
highly appreciated, as described in more detail at:

        http://www.OpenBSD.org/goals.html#funding

------------------------------------------------------------------------
- OPENBSD FOUNDATION ---------------------------------------------------

For those unable to make their contributions as straightforward gifts,
the OpenBSD Foundation (http://www.openbsdfoundation.org) is a Canadian
not-for-profit corporation that can accept larger contributions and
issue receipts.  In some situations, their receipt may qualify as a
business expense writeoff, so this is certainly a consideration for
some organizations or businesses.  There may also be exposure benefits
since the Foundation may be interested in participating in press releases.
In turn, the Foundation then uses these contributions to assist OpenBSD's
infrastructure needs.  Contact the foundation directors at
directors@openbsdfoundation.org for more information.

------------------------------------------------------------------------
- T-SHIRT SALES --------------------------------------------------------

The OpenBSD distribution companies also sell tshirts and polo shirts.
And our users like them too.  We have a variety of shirts available,
with the new and old designs, from our web ordering system at, as
described above.

The OpenBSD 4.6 t-shirts are available now.  We also sell our older
shirts, as well as a selection of OpenSSH t-shirts.

------------------------------------------------------------------------
- FTP INSTALLS ---------------------------------------------------------

If you choose not to buy an OpenBSD CD-ROM, OpenBSD can be easily
installed via FTP.  Typically you need a single small piece of boot
media (e.g., a boot floppy) and then the rest of the files can be
installed from a number of locations, including directly off the
Internet.  Follow this simple set of instructions to ensure that
you find all of the documentation you will need while performing
an install via FTP.  With the CD-ROMs, the necessary documentation
is easier to find.

1) Read either of the following two files for a list of ftp
   mirrors which provide OpenBSD, then choose one near you:

        http://www.OpenBSD.org/ftp.html
        ftp://ftp.OpenBSD.org/pub/OpenBSD/4.6/ftplist

   As of Oct 1, 2009, the following ftp mirror sites have the 4.6 release:

	ftp://ftp.stacken.kth.se/pub/OpenBSD/4.6/	Sweden
	ftp://ftp2.usa.openbsd.org/pub/OpenBSD/4.6/	NYC, USA
	ftp://ftp3.usa.openbsd.org/pub/OpenBSD/4.6/	CO, USA
	ftp://ftp5.usa.openbsd.org/pub/OpenBSD/4.6/	CA, USA
	ftp://rt.fm/pub/OpenBSD/4.6/			IL, USA

	The release is also available at the master site:

	ftp://ftp.openbsd.org/pub/OpenBSD/4.6/	Alberta, Canada

	However it is strongly suggested you use a mirror.

   Other mirror sites may take a day or two to update.

2) Connect to that ftp mirror site and go into the directory
   pub/OpenBSD/4.6/ which contains these files and directories.
   This is a list of what you will see:

        ANNOUNCEMENT     armish/          mvme68k/         sparc64/
        Changelogs/      ftplist          mvme88k/         src.tar.gz
        HARDWARE         hp300/           packages/        sys.tar.gz
        PACKAGES         hppa/            ports.tar.gz     tools/
        PORTS            i386/            root.mail        vax/
        README           landisk/         sgi/             xenocara.tar.gz
        alpha/           mac68k/          socppc/          zaurus/
        amd64/           macppc/          sparc/

   It is quite likely that you will want at LEAST the following
   files which apply to all the architectures OpenBSD supports.

        README          - generic README
        HARDWARE        - list of hardware we support
        PORTS           - description of our "ports" tree
        PACKAGES        - description of pre-compiled packages
        root.mail       - a copy of root's mail at initial login.
			  (This is really worthwhile reading).

3) Read the README file.  It is short, and a quick read will make
   sure you understand what else you need to fetch.

4) Next, go into the directory that applies to your architecture,
   for example, i386.  This is a list of what you will see:

	INSTALL.i386    cd46.iso        floppyB46.fs    pxeboot*
	INSTALL.linux   cdboot*         floppyC46.fs    xbase46.tgz
	MD5             cdbr*           game46.tgz      xetc46.tgz
	base46.tgz      cdemu46.iso     index.txt       xfont46.tgz
	bsd*            comp46.tgz      install46.iso   xserv46.tgz
	bsd.mp*         etc46.tgz       man46.tgz       xshare46.tgz
	bsd.rd*         floppy46.fs     misc46.tgz

   If you are new to OpenBSD, fetch _at least_ the file INSTALL.i386
   and the appropriate floppy*.fs or install46.iso files.  Consult the
   INSTALL.i386 file if you don't know which of the floppy images
   you need (or simply fetch all of them).

   If you use the install46.iso file (roughly 200MB in size), then you
   do not need the various *.tgz files since they are contained on that
   one-step ISO-format install CD.

5) If you are an expert, follow the instructions in the file called
   README; otherwise, use the more complete instructions in the
   file called INSTALL.i386.  INSTALL.i386 may tell you that you
   need to fetch other files.

6) Just in case, take a peek at:

        http://www.OpenBSD.org/errata.html

   This is the page where we talk about the mistakes we made while
   creating the 4.6 release, or the significant bugs we fixed
   post-release which we think our users should have fixes for.
   Patches and workarounds are clearly described there.

Note: If you end up needing to write a raw floppy using Windows,
      you can use "fdimage.exe" located in the pub/OpenBSD/4.6/tools
      directory to do so.

------------------------------------------------------------------------
- X.ORG FOR MOST ARCHITECTURES -----------------------------------------

X.Org has been integrated more closely into the system.  This release
contains X.Org 7.4.  Most of our architectures ship with X.Org, including
amd64, sparc, sparc64 and macppc.  During installation, you can install
X.Org quite easily.  Be sure to try out xdm(1) and see how we have
customized it for OpenBSD.

------------------------------------------------------------------------
- PORTS TREE -----------------------------------------------------------

The OpenBSD ports tree contains automated instructions for building
third party software.  The software has been verified to build and
run on the various OpenBSD architectures.  The 4.6 ports collection,
including many of the distribution files, is included on the 3-CD
set.  Please see the PORTS file for more information.

Note: some of the most popular ports, e.g., the Apache web server
and several X applications, come standard with OpenBSD.  Also, many
popular ports have been pre-compiled for those who do not desire
to build their own binaries (see BINARY PACKAGES, below).

------------------------------------------------------------------------
- BINARY PACKAGES WE PROVIDE -------------------------------------------

A large number of binary packages are provided.  Please see the PACKAGES
file (ftp://ftp.OpenBSD.org/pub/OpenBSD/4.6/PACKAGES) for more details.

------------------------------------------------------------------------
- SYSTEM SOURCE CODE ---------------------------------------------------

The CD-ROMs contain source code for all the subsystems explained
above, and the README (ftp://ftp.OpenBSD.org/pub/OpenBSD/4.6/README)
file explains how to deal with these source files.  For those who
are doing an FTP install, the source code for all four subsystems
can be found in the pub/OpenBSD/4.6/ directory:

        xenocara.tar.gz     ports.tar.gz   src.tar.gz     sys.tar.gz

------------------------------------------------------------------------
- THANKS ---------------------------------------------------------------

OpenBSD 4.6 includes artwork and CD artistic layout by Ty Semaka,
who also arranged an audio track on the OpenBSD 4.6 CD set.  Ports
tree and package building by Jasper Lievisse Adriaanse, Michael Erdely,
Simon Bertrang, Stuart Henderson, Antoine Jacoutot, Robert Nagy,
Nikolay Sturm, and Christian Weisgerber.  System builds by Theo de Raadt,
Mark Kettenis, and Miod Vallat.  X11 builds by Todd Fries and Miod Vallat.
ISO-9660 filesystem layout by Theo de Raadt.

We would like to thank all of the people who sent in bug reports, bug
fixes, donation cheques, and hardware that we use.  We would also like
to thank those who pre-ordered the 4.6 CD-ROM or bought our previous
CD-ROMs.  Those who did not support us financially have still helped
us with our goal of improving the quality of the software.

Our developers are:

    Alexander Bluhm, Alexander Hall, Alexander von Gernler,
    Alexander Yurchenko, Alexandre Ratchov, Alexey Vatchenko,
    Anders Magnusson, Andreas Gunnarsson, Anil Madhavapeddy,
    Antoine Jacoutot, Ariane van der Steldt, Artur Grabowski,
    Austin Hook, Benoit Lecocq, Bernd Ahlers, Bob Beck, Bret Lambert,
    Can Erkin Acar, Chad Loder, Charles Longeau, Chris Cappuccio,
    Chris Kuethe, Christian Weisgerber, Claudio Jeker,
    Constantine A. Murenin, Dale Rahn, Damien Bergamini, Damien Miller,
    Darren Tucker, David Gwynne, David Hill, David Krause, Eric Faurot,
    Esben Norby, Federico G. Schwindt, Felix Kronlage, Gilles Chehade,
    Giovanni Bechis, Gordon Willem Klok, Hans-Joerg Hoexer,
    Henning Brauer, Ian Darwin, Igor Sobrado, Ingo Schwarze,
    Jacek Masiulaniec, Jacob Meuser, Jakob Schlyter, Janne Johansson,
    Jared Yanovich, Jason Dixon, Jason George, Jason McIntyre,
    Jason Meltzer, Jasper Lievisse Adriaanse, Jim Razmus II, Joel Sing,
    Joerg Goltermann, Johan Mson Lindman, Jolan Luff, Jonathan Gray,
    Jordan Hargrave, Joris Vink, joshua stein, Kenneth R Westerback,
    Kevin Lo, Kevin Steves, Kjell Wooding, Kurt Miller, Landry Breuil,
    Laurent Fanis, Marc Espie, Marco Peereboom, Marco Pfatschbacher,
    Marco S Hyman, Marcus Glocker, Mark Kettenis, Mark Uemura,
    Markus Friedl, Martin Reindl, Martynas Venckus,
    Mathieu Sauve-Frankel, Mats O Jansson, Matthias Kilian,
    Matthieu Herrb, Michael Erdely, Michael Knudsen, Michele Marchetto,
    Mike Larkin, Miod Vallat, Moritz Grimm, Moritz Jodeit,
    Nicholas Marriott, Nick Holland, Nikolay Sturm, Okan Demirmen,
    Oleg Safiullin, Otto Moerbeek, Owain Ainsworth, Paul de Weerd,
    Paul Irofti, Peter Hessler, Peter Stromberg, Peter Valchev,
    Philip Guenther, Pierre-Emmanuel Andre, Pierre-Yves Ritschard,
    Rainer Giedat, Ray Lai, Reyk Floeter, Robert Nagy, Rui Reis,
    Ryan Thomas McBride, Simon Bertrang, Stefan Kempf, Steven Mestdagh,
    Stuart Henderson, Ted Unangst, Theo de Raadt, Thordur I. Bjornsson,
    Tobias Stoeckmann, Tobias Weingartner, Todd C. Miller, Todd Fries,
    Will Maier, William Yodlowsky, Xavier Santolaria, Yojiro Uo

When I worked as a Tivoli Consultant I spend a lot of time investigating the customer processes and workflow and try to make the monitoring solution to support this. It was often long term projects and involved alot of people like, project managers, support staff, maintenance staff, application owners, applicataion engineers, operating systemens managers, DBAs and so on.

Very often the investigation followed the following principles:

1. Investigate the problem management workflow
2. Document the different parts that builds up the system
3. Find spots where a probe could be inserted to monitor a particular part in the system
4. Define the thresholds for the probe
5. Iterate 3 and 4 until all possible problems in the system could be detected
6. Define who should have which alarm and when ifthe probes shows abnormal behavior.
7. Write the ruleset that implements 7
8. Test
9. Document and hand over to the customer

When it comes to a product like Nagios or op5 Monitor, the product has a built in rule engine that fullfills most of the requirements in the steps above. In most cases it is just a matter of configuration and in some cases some extra scripting.

Solution

I have run into rare cases where the builtin rule engine is not good enough and I have looked for a rule engine that fullfill the following requirements:

• Gnu Public Licence or another acceptable license
• Standalone
• Advanced enough
• Possible to integrate with other solutions like Nagios or op5 Monitor

Now I think I have found a good candidate, NodeBrain and right now I’m testing it.

I will do a follow up article where I describe howto integrate NodeBrain with Nagios or op5 Monitor.

An example

This is as an example of what a rule engine can do:

Webshop example

•  5 webfrontends, 1 or 2 down is OK, 3 is down is WARNING, 4 or 5 down is CRITICAL
• 2 appservers, 1 down is OK, 2 DOWN is CRITICAL
• 3 database backends, 1 down is OK, 2 down is WARNING, 3 down is CRITICAL
• Overall, the layer with the highest severity is the total severerity.

 Implementation:

The ruleset

#Start with webservers
#Set OK
assert weba=0;
assert webb=0;
assert webc=0;
assert webd=0;
assert webe=0;
assert  webserversstatus=0;

#Total rules
assert webshopstatus=0;
#If all serverstatus ok, the whole webshop is ok
define webshopok on(webserversstatus=0 and appserversstatus=0 and dbserversstatus=0) webshopstatus=0;
#If any serverstatus is critical the whole webshop is critical
define webshopscritical on(webserversstatus=2 or appserversstatus=2 or dbserversstatus=2) webshopstatus=2;
#If not any serverstatuscritical and in warning, the whole shop is warning.
define webshopwarning on((!webserversstatus=2 and !appserversstatus=2 and !dbserversstatus=2) and (webserversstatus=1 or dbserversstatus=1)) webshopstatus=1;

Testing:

./nb webshop.nb -
> assert weba=2;
> assert webb=2;
> assert webc=2;
2009/10/02 09:44:42 NB000I Rule webserverswarning fired (webserversstatus=1)
2009/10/02 09:44:42 NB000I Rule webshopwarning fired (webshopstatus=1)
> assert webd=2;
2009/10/02 09:45:06 NB000I Rule webserverscritical fired (webserversstatus=2)
2009/10/02 09:45:06 NB000I Rule webshopscritical fired (webshopstatus=2)
> assert webd=0;
2009/10/02 09:46:27 NB000I Rule webserverswarning fired (webserversstatus=1)
2009/10/02 09:46:27 NB000I Rule webshopwarning fired (webshopstatus=1)
> assert weba=0;
2009/10/02 09:46:32 NB000I Rule webserversok fired (webserversstatus=0)
2009/10/02 09:46:32 NB000I Rule webshopok fired (webshopstatus=0)
> assert appa=2;
> assert appb=2;
2009/10/02 09:47:12 NB000I Rule appserverscritical fired (appserversstatus=2)
2009/10/02 09:47:12 NB000I Rule webshopscritical fired (webshopstatus=2)
> assert weba=2;
2009/10/02 09:47:40 NB000I Rule webserverswarning fired (webserversstatus=1)
> assert webd=2;
2009/10/02 09:48:07 NB000I Rule webserverscritical fired (webserversstatus=2)
> assert appb=0;
2009/10/02 09:49:08 NB000I Rule appserversok fired (appserversstatus=0)
> assert weba=0;
2009/10/02 09:49:33 NB000I Rule webserverswarning fired (webserversstatus=1)
2009/10/02 09:49:33 NB000I Rule webshopwarning fired (webshopstatus=1)
> assert dba=2;
> assert dbb=2;
2009/10/02 09:51:05 NB000I Rule dbserverswarning fired (dbserversstatus=1)
> assert dbc=2;
2009/10/02 09:51:09 NB000I Rule dbservercritical fired (dbserversstatus=2)
2009/10/02 09:51:09 NB000I Rule webshopscritical fired (webshopstatus=2)
> show -t
@ = ! == node
webshopwarning = ! == on(((!(webserversstatus=2))&((!(appserversstatus=2))&(!(dbserversstatus=2))))&((webserversstatus=1)|(dbserversstatus=1))) webshopstatus=1;
webshopscritical = ! == on((webserversstatus=2)|((appserversstatus=2)|(dbserversstatus=2))) webshopstatus=2;
webshopok = ! == on((webserversstatus=0)&((appserversstatus=0)&(dbserversstatus=0))) webshopstatus=0;
webshopstatus = 2
dbservercritical = ! == on(dbservers>=6) dbserversstatus=2;
dbserverswarning = ! == on((dbservers>=4)&(dbservers<6)) dbserversstatus=1;
dbserversok = ! == on(dbservers<=2) dbserversstatus=0;
dbservers = 6 == ((dba+dbb)+dbc)
dbserversstatus = 2
dbc = 2
dbb = 2
dba = 2
appserverscritical = ! == on(appservers>2) appserversstatus=2;
appserversok = ! == on(appservers<=2) appserversstatus=0;
appservers = 2 == (appa+appb)
appserversstatus = 0
appb = 0
appa = 2
webserverscritical = ! == on(webservers>=8) webserversstatus=2;
webserverswarning = ! == on((webservers>4)&(webservers<8)) webserversstatus=1;
webserversok = ! == on(webservers<=4) webserversstatus=0;
webservers = 6 == ((((weba+webb)+webc)+webd)+webe)
webserversstatus = 1
webe = 0
webd = 2
webc = 2
webb = 2
weba = 0

> assert dbc=0;
2009/10/02 09:52:12 NB000I Rule dbserverswarning fired (dbserversstatus=1)
2009/10/02 09:52:12 NB000I Rule webshopwarning fired (webshopstatus=1)
> assert webb=0;
2009/10/02 09:52:31 NB000I Rule webserversok fired (webserversstatus=0)
> assert dba=0;
2009/10/02 09:52:45 NB000I Rule dbserversok fired (dbserversstatus=0)
2009/10/02 09:52:45 NB000I Rule webshopok fired (webshopstatus=0)

Links

• NodeBrain
• NodeBrain tutorial

To start a script in the default run levels:

sudo update-rc.d appname defaults

To remove a script from all runlevels:

sudo update-rc.d appname remove

op5 Monitor is based on Nagios*, the industry standard for enterprise-class IT infrastructure monitoring. Until now, op5 Monitor has had to rely on the basics of standard Nagios Graphical User Interface (GUI) for presentation and overall user experience. With the release of op5 Monitor 4.2 we include a fully functional preview of a brand new GUI, now based on the Ninja Open Source project. The new GUI is based on a modern PHP architecture and is now shipped for real operation testing.

Usability, flexibility and visualization probably stands for more then 80% of overall customer value. Our solutions for full control of our customers IT systems hold a huge amount of both historical data and instant events. Making this information accessible and easy to understand for as many as possible is the single most effective value for our customers. And who is better to give us important feedback on GUI related features and functions then our customers? This is why we now choose to include an early version for test, evaluation and feedback purposes, all to secure the best for the coming official release of Monitor 5.0 later this year, says Jan Josephson, CEO op5 AB.

The new GUI with its flexible interface based on the PHP framework makes it much easier to provide customizations for customers specific needs. With the introduction of widget and support session based authentication it is now possible to fully personalize views and settings. The widget technology further provides a future standard way for two way synchronization and presentation of customer unique data and the presentation of it.

The ability to search, sort and filter vast data volumes has been greatly improved with pagination for views of hosts and services and the possibility to sort by column. The new improved search feature includes auto suggestion and let you search on hosts, services host groups and service groups.
These changes greatly improves the possibilities to answer to customer needs and to develop customized features that has not been possible until now due to the restrictions from the old GUI.
A new module for network visualization (the NagVis project) has been included in op5 Monitor 4.2. You can now visualize your infrastructure using three different map types;

• Auto map, a auto drawn topology map using parent / child relationships.
• Static Map makes it possible to put any object (host, service, host group or service group) on an image of choice.
• Geo map, uses Google maps API, drawing a map by using addresses or gps coordinates on your monitored objects. Object and status information as well as links can be included in the map. The maps can be visualized as widgets on the tactical overview or be used on big monitors in operation centers.
• Largest OSS-project in Network Monitoring, Nagios.

About op5 AB op5 AB is a world leading OSM – Open Source Management – company that delivers software based on open source for control of IT systems and networks. Its main products are op5 Monitor, op5 Statistics and op5 LogServer. The products are based on open source code that op5 further develops, packages, and sells as complete products and systems with services and support. p5 has a large selection of primarily European clients from different market segments for example AGA Linde Gas, The Swedish Customs Service (Tullverket) and other parastatals, several county councils, municipalities and municipal companies. op5 was founded in 2003. The company is based in Sweden with offices in Stockholm and Gothenburg.

www.op5.com

Next week, op5 will release the new Nagios GUI called Ninja. The license is GPL and several people has reported the GUI work perfectly well on vanilla Nagios. Ninja uses a database backend. Merlin, another op5 developed software feeds the Nagios information into the database.

Links:

• op5 -OpenSource based management software company
• Ninja- Nagios Is Now Just Awesome
• Merlin – Module for Effortless Redundancy and Loadbalancing In Nagios
• Try – Ninja GUI

Some screenshoots below:

 Geomap, based on google maps

Tactical overview, with widgets that could be dragged and dropped

Host details

Nagvis integration

This article is describing best practice I have collected after a 10 year period with Systems- and Network  management. My role has varied between consultant, trainer, systems engineer, project manager and architect.

Very many programs creates log files. They are great for trouble shooting and in some cases the only place to find out if there is something wrong. 

A monitor friendly software has a way of figuring out the status this very moment by providing relevant information via for example:  SNMP, a web page, status stored in a database, a well documented API available in several different languages or similiar.

A NON monitor friendly application has for an example a javascript webpage where all the status can be read, unfortunatly this becomes more and more common.

When someone writes a piece of software, think about that someone else might want to know the status of it.

As a consultant working with monitoring and surveillance, I have meet several developers that has the attitude that their software never breaks if everything else works.:

-Just make sure that I get the data and all the surrounding pieces like databases, network, hardware and so on works, then my code will work flawless.

IMHO, unfortunatly the best way to meet that type of arguments is by just sit back and let them put their application into test and production. Focus on getting the other stuff monitored. Within a rather short while the development team will come back and ask how the best way of sending information into the monitoring solution is done.

The best way of building a monitored solution is to design the application to be monitored from the begining instead of trying to fix it afterwards.

In most cases a good enough solution can be created relativly simple afterwards and in some cases it is a little bit harder.

Guideline

My experience as surveilence expert working with Tivoli, BMC, HP OpenView, IBM NetView, BigBrother, Nagios and op5 Monitor can be collected in these simple guidelines:

• Keep it simple stupid.
  • Start with simple monitoring, like PING to make sure that the host is up and standard checks like http, smtp and so on to make sure that standard services are up. Going from no monitoring to basic monitoring is a huge step and many organizations do not have the processes to handle more complex monitoring.
  • The next step is disk, CPU and memory on hosts. On network devices are port load, cpu load, network link.
  • Third step is to dig into bussiness critical applications and services.
• Small iterations. Do not try to build a top of the line monitoring solution from day one. You will never leave the startup phase.
• Let the monitoring solution pull the status instead of sending the status to the monitroing solution. This avoid complicated rules when different types of information is sent to the monitoring solution. So avoid sending SNMPtraps.
• The monitoring solution is NOT a trashcan where to send tons of uninteresting garbage. It is far to common that HW vendors recommends to send thousands of unnecessary SNMPtraps to the monitoring solution and just a few is interesting. It is a nightmare to create the ruleset to figure out what is interesting, especially if there is dependencies where one message is interesting if another message has been sent before. The documentation is a badly written  MIB on a couple of hundered pages. In almost every case I’ve run into with this approch the implementation never ends and test cases are hard to create. When the systems are in production I can bet on that a critical event will occour which has not been taken care of and the production will stop. Managers will be upset, vendors will blame each other and customers will be angry.
• Let the status be availiable easily:
  • via standard APIs, Perl and Bash is the most common.
  • SNMP via SNMPget instead of SNMPtraps
  • Status stored in a database, the monitoring solution can run SQL quries to get the status.
  • Commands the can be runned by the monitoring solution and the output parsed, or even better, exit codes are used and documented.
• Normally it is not a good idea to read a log file to understand the status of of the software.

Afterword

This guide describes the guidelines howto collect the data for your monitor solution. In the next article I will describe howto implement and work with the information collected.

Stay tuned…

Links

• Another article written by op5 support
• Nagios, a great opensource monitoring software
• op5 Monitor, a monitoring software based on Nagios

As a former Novell employee there is one software I really miss and that is iFolder. It is an excellent file syncronization software. You configure iFolder where your local iFolder files are located and what server to syncronize against. Do a sync and now they are avilable at any iFolder instance if you sync against the same server. It works almost magical. You can have several machines where you create files, sync them. After that go to a fresh machine do a iFolder sync and volá there is the files.

According to Novell iFolder is OpenSourced but the installation is horrible on any other plattform then SuSE.

Solution

After some investigation I finally stumbled on Unison. Unison works on Unix like operating system like, Linux, BSD, OS X and also on Windows. It is in the Ubuntu repository and RHEL rpm package can be found here.

Simple example

Syncronize one directory testunison containing two files

peter@peter-laptop:~$ unison -ui text -contactquietly testunison ssh://zelda/testunison
peter@zelda's password:
Looking for changes
  Waiting for changes from server
Reconciling changes

local          zelda.mynet       
new file —->            a  [f]
new file —->            b  [f]

Proceed with propagating updates? [] y
Propagating updates

UNISON 2.27.57 started propagating changes at 21:56:43 on 27 Aug 2009
[BGN] Copying a from /home/peter/testunison to //zelda.mynet//home/peter/testunison
[BGN] Copying b from /home/peter/testunison to //zelda.mynet//home/peter/testunison
[END] Copying a
[END] Copying b
UNISON 2.27.57 finished propagating changes at 21:56:43 on 27 Aug 2009

Saving synchronizer state
Synchronization complete  (2 items transferred, 0 skipped, 0 failures)

Links

• Unison homepage: http://www.cis.upenn.edu/~bcpierce/unison/
• Unison tutorial

I use MythTV quite frequently and noticed that it is instable when using sasc-ng as a decoder to decrypt encrypted DVB-T channels. So approximatly every third day the MythTVbackend server stops and need to be started again. I have wriiten an earlier article about howto monitor MythTV with Nagios or op5 Monitor so I get noticed that it has stopped. But I need to manually start it again. This article describe howto make Nagios or op5 Monitor to start a stopped MythTVbackend. It can be used for starting almost any service.

I have used the examples provided by Ethan at Nagios official documentation describing eventhandlers.

Normally it is not recommended to let a tool like Nagios or op5 Monitor start a service that has stopped, because it is probably a reason why the service has stopped and the correct procedure is to fix the root cause of the problem, not the symptom.

The MythTV backend runs on one machine called lala (after a character in Teletubbies) which is not the same as the Nagios or op5 Monitor server. I use nrpe to run the start script i.e.

 /etc/init.d/mythtv-backend start

There is several options here but I already setup the nrpe agent and it is simple to make Nagios or op5 Monitor to use nrpe to run a script.

Implementation

I used the script I found at Nagios documentation about eventhandlers as a base and modiied it slightly.

At my op5 Monitor machine

/opt/plugins/custom/restart-mythtv-lala.sh

#!/bin/sh
#
# Event handler script for restarting the mythTVbackend server on lala
#
# Note: This script will only restart the mythtvbackend if the service is
#       retried 2 times (in a "soft" state) or if the service somehow
#       manages to fall into a "hard" error state.
#

# What state is the mythbackend service in?
case "$1" in
OK)
	# The service just came back up, so don't do anything...
	;;
WARNING)
	# We don't really care about warning states, since the service is probably still running...
	;;
UNKNOWN)
	# We don't know what might be causing an unknown error, so don't do anything...
	;;
CRITICAL)
	# Aha!  The HTTP service appears to have a problem - perhaps we should restart the server...

	# Is this a "soft" or a "hard" state?
	case "$2" in

	# We're in a "soft" state, meaning that Nagios is in the middle of retrying the
	# check before it turns into a "hard" state and contacts get notified...
	SOFT)

		# What check attempt are we on?  We don't want to restart the web server on the first
		# check, because it may just be a fluke!
		case "$3" in

		# Wait until the check has been tried 3 times before restarting the web server.
		# If the check fails on the 4th time (after we restart the web server), the state
		# type will turn to "hard" and contacts will be notified of the problem.
		# Hopefully this will restart the web server successfully, so the 4th check will
		# result in a "soft" recovery.  If that happens no one gets notified because we
		# fixed the problem!
		2)
			echo "`date` Restarting mythtv service (2rd soft critical state)..." >> /tmp/mythtvstart
			# Call the init script to restart the mythbackend server
			#/etc/rc.d/init.d/httpd restart
			#date >> /tmp/mythtvstart
			/opt/plugins/check_nrpe -H lala -c start_mythtvbackend
			;;
			esac
		;;

	# The mythtvbackend service somehow managed to turn into a hard error without getting fixed.
	# It should have been restarted by the code above, but for some reason it didn't.
	# Let's give it one last try, shall we?
	# Note: Contacts have already been notified of a problem with the service at this
	# point (unless you disabled notifications for this service)
	HARD)
		echo "`date` Restarting mythtv service (hard state)..." >> /tmp/mythtvstart
		# Call the init script to restart the HTTPD server
		#/etc/rc.d/init.d/httpd restart
		#date >> /tmp/mythtvstart
		/opt/plugins/check_nrpe -H lala -c start_mythtvbackend
		;;
	esac
	;;
esac
exit 0

/opt/monitor/misccomands.cfg

# command 'restart-mythtv-lala'
define command{
    command_name                   restart-mythtv-lala
    command_line                   /opt/plugins/custom/start-mythtv-lala.sh $SERVICESTATE$ $SERVICESTATETYPE$ $SERVICEATTEMPT$
    }

/opt/monitor/etc/services.cfg

# service 'Mythbackend'
define service{
    use                            default-service
    host_name                      lala
    service_description            Mythbackend
    check_command                  check_tcp!6543
    servicegroups                  MythTV,it-slav
    event_handler                  restart-mythtv-lala!$SERVICESTATE$ $SERVICESTATETYPE$ $SERVICEATTEMPT$
    contact_groups                 it-slav_sms,it-slav_jabber,it_slav_mail
    }

At my mythbackend machine lala

/etc/nrpe.d/mycommands.cfg
command[start_mythtvbackend]=/usr/bin/sudo /etc/init.d/mythtv-backend start

/etc/sudoers
nobody ALL= (root) NOPASSWD:/etc/init.d/mythtv-backend start

Test

I stopped the mythtvbackend by running:

peter@lala:/etc/nrpe.d$ date
Mon Jun 15 20:40:55 CEST 2009
peter@lala:/etc/nrpe.d$ sudo /etc/init.d/mythtv-backend stop
 * Stopping MythTV server: mythbackend

And run

[root@op5 ~]# tail -f /tmp/mythtvstart
Mon Jun 15 20:47:09 CEST 2009 Restarting mythtv service (2rd soft critical state)...

YES it works!

Links:

• op5 Monitor a Nagios based supported enterprise Monitoring software.
• MythTV a free OpenSource Digital Video Recorder
• Nagios Open Source Monitoring

This article describes how to monitor an IPSEC tunnel running on OpenBSD. I could not find any plugin already done so I created my own.

The pre req. for this article are:

• A working Nagios or op5 Monitor setup
• A IPsec VPN tunnel running on OpenBSD
• A working NRPE agent at the OpenBSD box

Theory

The way of getting the status of IPsec on OpenBSD is buy running:

ipsecctl -s s

esp tunnel from x.x.x.x to y.y.y.y spi 0xe58a63d3 auth hmac-md5 enc 3des-cbc \
       authkey 0xabcdfghijklmnopqrstuvxyz \
       enckey 0xabcdfghijklmnopqrstuvxyz
esp tunnel from y.y.y.y to x.x.x.x spi 0x555f1f13 auth hmac-md5 enc 3des-cbc \
      authkey 0xabcdfghijklmnopqrstuvxyz \
       enckey 0xabcdfghijklmnopqrstuvxyz

This shows that the IPsec tunnel between x.x.x.x and y.y.y.y is up.

Depending of the OpenBSD version the output will be different.

Plugin

I put the plugin in /opt/plugins/custom at my OpenBSD box.

#!/bin/sh
#
# Copyright (C) 2009 Peter Andersson, peter@it-slav.net
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
#
# Very simple plugin that checks if a ipsec vpn is up between to ip-adresses
# Tested on OpenBSD 4.0
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see .
#
# Example use of this script:
# ./check_ipsecctl 10.1.1.1 10.2.1.1 "VPN HQ"
# OK: VPN HQ is up
#
# ./check_ipsecctl 10.1.1.1 10.2.1.1 "VPN HQ"
# CRITICAL: VPN HQ is down (No IP-SEC VPN from 10.1.1.1 to 10.2.1.1  No IP-SEC VPN from 10.2.1.1 to 10.1.1.1)
#
#
IPSECCTL="/sbin/ipsecctl -s sa"
STATUS=0

LINE1=`$IPSECCTL | grep "from $1 to $2" `
if [ $? -eq 1 ]; then
        STATUS=2;
        OUTPUT1="No IP-SEC VPN from $1 to $2 "
fi

LINE2=`$IPSECCTL | grep "from $2 to $1" `
if [ $? -eq 1 ]; then
        STATUS=2;
        OUTPUT2="No IP-SEC VPN from $2 to $1"
fi

if [ $STATUS -eq 0 ]; then
        echo "OK: $3 is up"
        exit $STATUS
else
        echo "CRITICAL: $3 is down ($OUTPUT1 $OUTPUT2)"
        exit $STATUS
fi

Nrpe config

Nagios run check_ipsecctl via NRPE, it mus run as a privileged user and I use sudo, in /etc/nrpe.cfg

command[vpn_johan]=sudo /opt/plugins/custom/check_ipsecctl x.x.x.x y.y.y.y "VPN Johan"

x.x.x.x and y.y.y.y are the IP-addresses where the VPN tunnel terminates

Sudo

Use sudoedit /etc/sudoers to modify the sudo config file:

nagios  ALL=(root) NOPASSWD: /opt/plugins/custom/check_ipsecctl

Nagios or op5 Monitor configuration

The VPN connection can be treated as a service running on the OpenBSD box, but in my opinion, the VPN  should be treated as a host using the plugin above to check that the host is alive, and the hosts at the other end of the VPN connection should have the  VPN tunnel as parent. The advantage is that if the VPN tunnel is down the hosts and services behind it is unreachable, which is the correct behavior.

hosts.cfg

# host template 'default-hosttemplate-nrpe'
define host{
    name                           default-hosttemplate-nrpe
    check_command                  check_nrpe
    max_check_attempts             5
    obsess_over_host               0
    check_freshness                0
    active_checks_enabled          1
    passive_checks_enabled         1
    event_handler_enabled          1
    flap_detection_enabled         1
    flap_detection_options         n
    process_perf_data              1
    retain_status_information      1
    retain_nonstatus_information   1
    notification_interval          0
    notification_period            24x7
    notification_options           d,u,r,f
    notifications_enabled          1
    stalking_options               n
    register                       0
    }
# host 'vpn-johan'
define host{
    use                            default-hosttemplate-nrpe
    host_name                      vpn-johan
    alias                          vpn johan
    address                        10.1.1.1
    parents                        internet
    check_command                  check_nrpe!vpn_johan
    contact_groups                 it-slav_msn,it-slav_mail,call_it-slav
    }

10.1.1.1 is the IP-adress to my OpenBSD box. The reason for using a template is that I’m using the webbased config tool that comes with op5 Monitor.

The result

Links

• Nagios
• op5 Monitor a Nagios based full supported monitor solution
• OpenBSD, a FREE, multi-platform 4.4BSD-based UNIX-like operating system.
• IPsec, a suite of protocols for securing Internet Protocol communications by authenticating and encrypting each IP packet of a data stream.

This article describe howto use a USB camera (also known as webcam) to detect motions and send an alarm to Nagios or op5 Monitor. It can be used in datacenters to send an alert if someone or something is moving or at home to detect if someone is in your house. I will place the camera just inside the door so everybody passing my front door will be filmed and an alert will be sent to me.

The software used:

• Motion, to detect movement and create a movie of the relevant time, pictures is also taken.
• Nagios or op5 Monitor to create the alarm.

The hardware used is an old Logitech webcam I found in my fathers drawer Motion supports alot of different devices but must simple is to use a video4linux supported device.

The pre req. for this article is a working Nagios or op5 Monitor system.

Installation

I have an Ubuntu system where I attach the webcamera, dmesg gives me:

[634581.861029] usb 1-2: new full speed USB device using uhci_hcd and address 3
[634582.032251] usb 1-2: configuration #1 chosen from 1 choice
[634582.034125] quickcam: QuickCam USB camera found (driver version QuickCam USB 0.6.6 $Date: 2006/11/04 08:38:14 $)
[634582.034144] quickcam: Kernel:2.6.27-11-generic bus:1 class:FF subclass:FF vendor:046D product:0870
[634582.048202] quickcam: Sensor HDCS-1020 detected
[634582.050173] quickcam: Registered device: /dev/video0

Installing motion is simple, just run:

sudo apt-get install motion

I will use passive checks to let motion send in alerts to Nagios, the best way of doing that is by using NSCA, for theory refer to an earlier article.

sudo apt-get install nsca

Test motion

The first thing to test is that motion works, for me to get it to work I needed no configuration, run:

sudo motion

and dance in front of your camera.

Now motion should inform that it has created pictures and a movie.

Configuration

Configure Nagios or op5 Monitor to accept alerts sent from motion:

# service 'Camera Motion Detection'
define service{
 use                            default-service
 host_name                      lala
 service_description            Camera Motion Detection
 check_command                  check_dummy!0 "No motion detected"
 max_check_attempts             1
 active_checks_enabled          0
 flap_detection_options         n
 contact_groups                 it-slav_msn,it-slav_mail,call_it-slav
 stalking_options               n
 check_freshness                1
 freshness_threshold            3600
}

If nothing has been sent within an hour (3600 seconds), the state is set to OK by using freshness and check_dummy.

Create /home/motion/scripts/check_camera_motion/send_nsca.cfg

encryption_method=0

Create /home/motion/scripts/check_camera_motion/passive_camera_warning

lala    Camera Motion Detection    1    WARNING: Motion detected

The separator must be TAB

In /etc/motion/motion.conf, find the parameter on_event_start and change it to:

on_event_start  cd /home/motion/scripts/check_camera&&send_nsca -H op5.mynet -c send_nsca.cfg < passive_camera_warning

And an alert will be sent to Nagios everytime motion detects a motion.

Start motion with:

sudo motion

And do the dancing again, now you should have an Nagios alarm with status WARNING.

Hint

A good idea could be to change the parameters target_dir and snapshot_filename to a directory where you can point apache websever, so you can use a webbrowser to browse your images and movies.

Links

• Motion, the software used to detect motions
• Nagios
• op5 Monitor, a supported version of Nagios

Pre requirements

The pre requriements for this article is a working Nagios or op5 Installation and a working MySql database.

Plugin

The plugin used in this article is: http://www.consol.de/opensource/nagios/check-mysql-health

Unfortunatly the webpage is in German only.

Enable MySql to retrive information

mysql> grant usage on *.* to 'nagios'@'op5' identified by 'XXXX-';

op5 is the nagios hostname.

Download the plugin, install and test

Download the plugin from http://www.consol.de/fileadmin/opensource/Nagios/check_mysql_health-2.0.4.tar.gz

I put it into /opt/plugins/custom/check_mysql_health at the Nagios server.

Test the command by running at the Nagios server:

[root@op5 custom]# ./check_mysql_health -H mysqlhost --user nagios --password XXXX  --mode threads-connected
 OK - 5 client connection threads | threads_connected=5;10;20

It works!!

To get a list of what the check_mysql_health plugin can monitor run:

[root@op5 custom]# ./check_mysql_health --help

Configure Nagios or op5 Monitor

I find the following parameters interesting to monitor:

• connection-time
• keycache-hitrate
• qcache-hitrate
• tablecache-hitrate
• threadcache-hitrate
• tmp-disk-tables

checkcommands.cfg

# command 'check_mysql_health'
 define command{
 command_name                   check_mysql_health
 command_line                   $USER1$/custom/check_mysql_health -H $HOSTADDRESS$ --user $ARG1$ -password $ARG2$ --mode $ARG3$
 }

# command 'check_mysql_health_tresholds'
 define command{
 command_name                   check_mysql_health_tresholds
 command_line                   $USER1$/custom/check_mysql_health -H $HOSTADDRESS$ --user $ARG1$ -password $ARG2$ --mode $ARG3$ --warning $ARG4$ --critical $ARG5$
 }

I created a servicegroup named mysql

servicegroups.cfg

# servicegroup 'mysql'
 define servicegroup{
 servicegroup_name              mysql
 alias                          MySQL
 }

I use the default thresholds in my servicedefinitions, but use check_mysql_health_thresholds instead if thresholds are required.
services.cfg

# service 'MySQL connection-time'
 define service{
 use                            default-service
 host_name                      lala
 service_description            MySQL connection-time
 check_command                  check_mysql_health!nagios!XXXX!connection-time
 servicegroups                  mysql
 contact_groups                 it-slav_msn,it-slav_mail,call_it-slav
 }

# service 'MySQL keycache-hitrate'
 define service{
 use                            default-service
 host_name                      lala
 service_description            MySQL keycache-hitrate
 check_command                  check_mysql_health!XXXX!keycache-hitrate
 servicegroups                  mysql
 contact_groups                 it-slav_msn,it-slav_mail,call_it-slav
 }

# service 'MySQL qcache-hitrate'
 define service{
 use                            default-service
 host_name                      lala
 service_description            MySQL qcache-hitrate
 check_command                  check_mysql_health!nagios!XXXX!qcache-hitrate
 servicegroups                  mysql
 contact_groups                 it-slav_msn,it-slav_mail,call_it-slav
 }

# service 'MySQL tablecache-hitrate'
 define service{
 use                            default-service
 host_name                      lala
 service_description            MySQL tablecache-hitrate
 check_command                  check_mysql_health!nagios!XXXX!tablecache-hitrate
 servicegroups                  mysql
 contact_groups                 it-slav_msn,it-slav_mail,call_it-slav
 }

# service 'MySQL threadcache-hitrate'
 define service{
 use                            default-service
 host_name                      lala
 service_description            MySQL threadcache-hitrate
 check_command                  check_mysql_health!nagios!XXXX!threadcache-hitrate
 servicegroups                  mysql
 contact_groups                 it-slav_msn,it-slav_mail,call_it-slav
 }

# service 'MySQL tmp-disk-tables'
 define service{
 use                            default-service
 host_name                      lala
 service_description            MySQL tmp-disk-tables
 check_command                  check_mysql_health!nagios!XXXX!tmp-disk-tables
 servicegroups                  mysql
 contact_groups                 it-slav_msn,it-slav_mail,call_it-slav
 }

The result

Conclusions and wrap-up

The default values are in many cases not sufficent, I have no database that do not get WARNING or CRITICAL when the default thresholds are used. If that is because the thresholds are not realistic or if it my applications that are badly implemented I do not know. So the databases needs tuning and the thresholds must be changed to get rid of constant errormessages.

Links

• op5 Monitor
• Nagios
• Tuning MySQL
• The plugin used in this article check_mysql_health

Wordpress uses the following parts to work:

• Webserver frontend
• PHP scripts
• MySQL database backend
• At least one system to run it on

I found one article describing howto monitor the Webserver and the MySQL database and even that a certain webpage contain a certain phrase. But I would like to emulate a user that clicks on some pages and graph the performance.

The tool I like for in-depth web monitoring is webinject. It allows scripting a simulated web user with alot of features.

I recommend to read the excellent how-to written by op5 support team and of cource use webinjects reference manual.

The testcase I’ve created looks like this:

<testcases repeat="1">
<case
    id="1"
    description1="Startsidan www.it-slav.net/blogs"
    method="get"
    url="http://www.it-slav.net/blogs/"
    verifypositive="An It-Slave in the digital saltmine"
/>
<case
    id="2"
    description1="Nagios or op5 Monitor plugin for 1-wire humidity measurement"
    method="get"
    url="http://www.it-slav.net/blogs/?p=802"
    verifypositive="1-wire humidity probe"
/>
<case
    id="3"
    description1="op5 Monitor or Nagios plugin for 1-wire temperature measurement"
    method="get"
    url="http://www.it-slav.net/blogs/?p=115"
    verifypositive="check_1-wiretemp"
/>
<case
    id="4"
    description1="Wp-Admin"
    method="get"
    url="http://www.it-slav.net/blogs/wp-admin"
    verifyresponsecode="301"
/>
</testcases>

And when run in Nagios mode:

[root@op5 webinject]# ./webinject.pl -c config.xml testcases/wordpressblog.xml
WebInject OK - All tests passed successfully in 4.143 seconds |time=4.143;10;;0

In checkcommands.cfg:

# command 'check_webinject'
define command{
    command_name                   check_webinject
    command_line                   $USER1$/webinject/webinject.pl testcases/$ARG1$
    }

In services.cfg:

# service 'Webinject Blog'
define service{
    use                            default-service
    host_name                      dull
    service_description            Webinject Blog
    check_command                  check_webinject!wordpressblog.xml
    contact_groups                 it-slav_sms,it-slav_mail,call_it-slav
    }

This is a nice pnp graph of my Webinject check:

Links:

• Webinject
• op5 Webinject Howto
• Nagios
• op5 Monitor

My blog that uses MySQL as the database backend suddenly got real performance issues. The symptoms where:

• All my Nagios test failed from time to time with NRPE timeout
• The performence of my dynamic webpages was terrible slow.
• The load on the system showed very heavy load, more then 10 for  1, 5, and 15 minutes.
• When using “top” the CPU load on both CPUs was almost 100% and it was almost only httpd processes.
• According to Firefox plugin Firebug it took about 12 seconds to load the startpage with me as the only user.

This bad behavior did not show up when I pointed my webbrowser to static http pages so my conclusion was that I had som problem with MySQL.

The numbers of unique visitors are about 100 / day and 250 page views /day and the machine is:

• Dual PIII 1Ghz
• 4 Gb ram
• SCA 10k RPM disk.

So the hardware should be able to handle the load without any problems.

Solution

The natural way of finding a solution to this was to Google and see if anybody else has run into this problem. The easiest way seemed to be to turn of Wordpress plugins I use to collect statistics. I found a couple of webpages describing howto tune MySQL, but they where assuming deeper knowledge in MySQL then I have. I also tried the MySQL manuals and I came to the conclusion that I probably must spend quite much time to understand the behavior and how to tune MySQL.

In my opinion my MySQL implementation is quite simple and the need to tune it seemed overhelming, until I find a very neat script that helped my to set MySQL parameters:

http://www.day32.com/MySQL/tuning-primer.sh

After tuning MySQL with the hints I got from the script the system started to behave totally differently:

• The load changed to load average to less then 0.15
• “top” shows more or less 100% idle
• Load a blog webpage changed from 12 seconds down to 1,2 seconds
• No more NRPE timeout problems from Nagios

A run of the script looks like this AFTER tuning:

[root@dull mysql-tuning]# ./tuning-primer.sh
mysqld is alive

	-- MYSQL PERFORMANCE TUNING PRIMER --
	     - By: Matthew Montgomery -

MySQL Version 5.0.45 i686

Uptime = 0 days 0 hrs 14 min 28 sec
Avg. qps = 6
Total Questions = 5926
Threads Connected = 9

Warning: Server has not been running for at least 48hrs.
It may not be safe to use these recommendations

To find out more information on how each of these
runtime variables effects performance visit:

http://dev.mysql.com/doc/refman/5.0/en/server-system-variables.html

Visit http://www.mysql.com/products/enterprise/advisors.html
for info about MySQL's Enterprise Monitoring and Advisory Service

SLOW QUERIES
The slow query log is NOT enabled.
Current long_query_time = 3 sec.
You have 0 out of 5947 that take longer than 3 sec. to complete
Your long_query_time seems to be fine

BINARY UPDATE LOG
The binary update log is NOT enabled.
You will not be able to do point in time recovery
See http://dev.mysql.com/doc/refman/5.0/en/point-in-time-recovery.html

WORKER THREADS
Current thread_cache_size = 10
Current threads_cached = 2
Current threads_per_sec = 0
Historic threads_per_sec = 0
Your thread_cache_size is fine

MAX CONNECTIONS
Current max_connections = 60
Current threads_connected = 9
Historic max_used_connections = 11
The number of used connections is 18% of the configured maximum.
Your max_connections variable seems to be fine.

MEMORY USAGE
Max Memory Ever Allocated : 103 M
Configured Max Per-thread Buffers : 161 M
Configured Max Global Buffers : 74 M
Configured Max Memory Limit : 235 M
Physical Memory : 3.39 G
Max memory limit seem to be within acceptable norms

KEY BUFFER
Current MyISAM index space = 4 M
Current key_buffer_size = 32 M
Key cache miss rate is 1 : 101
Key buffer fill ratio = 1.00 %
Your key_buffer_size seems to be too high.
Perhaps you can use these resources elsewhere

QUERY CACHE
Query cache is enabled
Current query_cache_size = 32 M
Current query_cache_used = 288 K
Current query_cache_limit = 32 M
Current Query cache Memory fill ratio = .87 %
Current query_cache_min_res_unit = 4 K
Your query_cache_size seems to be too high.
Perhaps you can use these resources elsewhere
MySQL won't cache query results that are larger than query_cache_limit in size

SORT OPERATIONS
Current sort_buffer_size = 2 M
Current read_rnd_buffer_size = 256 K
Sort buffer seems to be fine

JOINS
Current join_buffer_size = 132.00 K
You have had 0 queries where a join could not use an index properly
Your joins seem to be using indexes properly

OPEN FILES LIMIT
Current open_files_limit = 2470 files
The open_files_limit should typically be set to at least 2x-3x
that of table_cache if you have heavy MyISAM usage.
Your open_files_limit value seems to be fine

TABLE CACHE
Current table_cache value = 1200 tables
You have a total of 115 tables
You have 122 open tables.
The table_cache value seems to be fine

TEMP TABLES
Current max_heap_table_size = 128 M
Current tmp_table_size = 128 M
Of 518 temp tables, 24% were created on disk
Created disk tmp tables ratio seems fine

TABLE SCANS
Current read_buffer_size = 128 K
Current table scan ratio = 78 : 1
read_buffer_size seems to be fine

TABLE LOCKING
Current Lock Wait ratio = 1 : 3415
You may benefit from selective use of InnoDB.

This article describe howto get a 1-wire humidity probe to work with Nagios or op5 Monitor.

In an earlier article I have described a 1-wire temperature plugin.

Pre requriments

To get it working you need:

• 1-wire humidity probe i.e. this, it is based on DS2438 & HIH-4000
• A working owfs installation, instructions can be found here
• Nagios or op5 Monitor

check_1-wirehumid

The plugin is written in perl and version 1.0 can be downloaded here

#!/usr/bin/perl -w
#
# Check humidity of 1Wire device
# Requires use of Fuse and owfs
#
#
# By Peter Andersson
# peter@it-slav.net
# http://www.it-slav.net/blogs/?p=802
# Licence GPLv2
# Version 1.0

use strict;
use Getopt::Std;
use OW;

my $owserver = "127.0.0.1:3001";
my(%ERRORS) = ( OK=>0, WARNING=>1, CRITICAL=>2, UNKNOWN=>3 );

my $humidity;
my $status=$ERRORS{OK};;
my $message;

my $debug_flag=0;

our($opt_c, $opt_w, $opt_W, $opt_C, $opt_h, $opt_o, $opt_i);

getopts("w:W:c:C:ho:i:");

sub printhelp () {
	print "Usage: check_1-wirehumid [-h] -c lowhumidcritical -w lowhumidwarning -W highhumidwarning -C highhumidcritical -i id [-o owserver:port]\n";
	print "-h Help, this text\n-c num Critical threshold for low humidity\n-w num Warning threshold for low humidity\n";
	print "-W num Warning threshold for high humidity\n-C num Critical threshold for high humidity\n";
	print "-o <name|ip>:port, Servername of 1-wire server and portnumber the owserver use, default 127.0.0.1:3001\n";
	print "-i 1-wire ID, i.e. 10.DEF05F01080015\n";
	print "\n\t\tby Peter Andersson\n\t\tpeter\@it-slav.net\n\t\thttp://www.it-slav.net/blogs/?p=802\n";
	exit $status;
}

#sanity check
if (!$opt_c||!$opt_w||!$opt_W||!$opt_C||$opt_h) {
	$status= $ERRORS{UNKNOWN};
	&printhelp;
} elsif ($opt_c > $opt_w) {
	print "Critical low threshold must be higher or equal to warning low threshold\n";
	$status= $ERRORS{UNKNOWN};
	&printhelp;
} elsif ($opt_w > $opt_W || $opt_c > $opt_C) {
	print "Lower tresholds must be lower then higher thresholds\n";
	$status= $ERRORS{UNKNOWN};
	&printhelp;
} elsif ($opt_C < $opt_W) {
	print "Higher critical threshold must be higher or equal to higher warning threshold\n";
	$status= $ERRORS{UNKNOWN};
	&printhelp;
}

if ($opt_o) {
	$owserver = $opt_o;
}

unless(OW::init($owserver)) {
	$status = $ERRORS{CRIT};
	$message = "OWServer not running at $owserver\n";
	exit $status;
}
$humidity = OW::get("$opt_i/humidity");
$humidity =~ s/^\s*(.*?)\s*$/$1/; #remove whitespaces
unless (($humidity =~ /^-?(?:\d+(?:\.\d*)?|\.\d+)$/) || ($humidity =~ /^[+-]?\d+$/)) #check that it is an integer or decimal returned
{
	$message="Did not got an integer or a decimal from humidity probe";
        $status=$ERRORS{CRITICAL};
}
$humidity = sprintf("%.0f", $humidity);

if ($debug_flag) {
	print "opt_c:$opt_c opt_w:$opt_w opt_W:$opt_W opt_C:$opt_C opt_h:$opt_h owserver:$owserver opt_i:$opt_i Humidity:$humidity\n";
}

if ($humidity <= $opt_c) {
	$status=$ERRORS{CRITICAL};
	$message="CRITICAL";
} elsif ($humidity > $opt_c && $humidity <= $opt_w) {
	$status=$ERRORS{WARNING};
	$message="WARNING";
} elsif ($humidity >  $opt_w && $humidity <  $opt_W) {
	$status=$ERRORS{OK};
	$message="OK";
} elsif ($humidity >= $opt_W && $humidity < $opt_C) {
	$status=$ERRORS{WARNING};
	$message="WARNING";
} elsif ($humidity >= $opt_C) {
	$status=$ERRORS{CRITICAL};
	$message="CRITICAL";
} else { #This should never happend
	$status=$ERRORS{UNKNOWN};
	$message="UNKNOW";
}

print "$message: $humidity \%\|humidity=$humidity\%\;$opt_c;$opt_w;$opt_W;$opt_C\n";
exit $status;

Test the plugin by run:

[root@op5 custom]# ./check_1-wirehumid -c 10 -w 20 -W 90 -C 95 -i 26.D7EABC000000
OK: 31 %|humidity=31%;10;20;90;95

So I have 31 % humidity.

Nagios config files

In checkcommands.cfg, define check_1-wirehumid

# command 'check_1-wirehumid'
define command{
    command_name                   check_1-wirehumid
    command_line                   $USER1$/custom/check_1-wirehumid -c $ARG1$ -w $ARG2$ -W$ARG3$ -C$ARG4$ -i $ARG5$ -o $ARG6$
    }

In serviced.cfg, define the check. I have a service group called Environemnt where all my Environments probes are.

# service 'Washroom Humidity'
define service{
    use                            default-service
    host_name                      monitor
    service_description            Washroom Humidity
    check_command                  check_1-wirehumid!10!20!80!90!26.D7EABC000000!127.0.0.1:3001
    servicegroups                  Environment
    contact_groups                 it-slav_msn,it-slav_mail,call_it-slav
    }

Screenshots

This is a screen shoot from op5 Monitor showing my Servicegroup Environment.

If you have op5 Monitor or PNP for Nagios, graphs like this will automatically be created. Note that I had a shower 6.20 and the humidity went from approx 25% to 95% in a couple of minutes.